7. In a knowledge-based authentication (KBA) system, an apparatus constructed and arranged to generate a set of questions, the apparatus comprising: a network interface; memory; and a controller including controlling circuitry coupled to the memory, the controlling circuitry being constructed and arranged to: collect a set of facts that have references to a population of users; receive a request to authenticate a particular user claiming to belong to a group of users included in the population of users; in response to the request, identify a set of group facts, each group fact of the set of group facts being included in the set of facts and having references to users of the group of users; and generate the set of questions from the set of group facts, responses to questions of the set of questions provided by the particular user being indicative of whether the particular user belongs to the group of users; wherein generating the set of questions from the set of group facts includes: for each group fact of the set of group facts, producing an internal link strength that represents a number of users of the group of users referenced by that group fact; using a group fact of the set of group facts to produce a question of the set of questions when the internal link strength for the group fact is greater than a threshold internal link strength; and not using the group fact in producing questions of the set of questions when the internal link strength for the group fact is less than the threshold internal link strength.
7. In a knowledge-based authentication (KBA) system, an apparatus constructed and arranged to generate a set of questions, the apparatus comprising: a network interface; memory; and a controller including controlling circuitry coupled to the memory, the controlling circuitry being constructed and arranged to: collect a set of facts that have references to a population of users; receive a request to authenticate a particular user claiming to belong to a group of users included in the population of users; in response to the request, identify a set of group facts, each group fact of the set of group facts being included in the set of facts and having references to users of the group of users; and generate the set of questions from the set of group facts, responses to questions of the set of questions provided by the particular user being indicative of whether the particular user belongs to the group of users; wherein generating the set of questions from the set of group facts includes: for each group fact of the set of group facts, producing an internal link strength that represents a number of users of the group of users referenced by that group fact; using a group fact of the set of group facts to produce a question of the set of questions when the internal link strength for the group fact is greater than a threshold internal link strength; and not using the group fact in producing questions of the set of questions when the internal link strength for the group fact is less than the threshold internal link strength. 8. An apparatus according to claim 7 , wherein collecting the set of facts includes: for each fact of the set of facts, generating a link table of users of the population of users to which the fact has a reference, and wherein identifying the set of group facts includes: finding the facts of the set of facts for which the link table includes users of the group of users.