A web application allows users to reset their passwords by answering a security question ('What is your mother's maiden name?'). Why is this considered a weak authentication factor?

• A.Answers are often shared across sites (the same pet name appears on many accounts), a weakness that one breach exposes everywhere
• B.The answers are often guessable from public information (social media, public records) or obtainable via social engineering
• C.Answers are often case sensitive (users mistype them), locking out many genuine owners at recovery time
• D.Answers are often stored in plaintext (a fixed column in the user table), unlike hashed passwords