Lets say a secret word is say, the name of your first pet. Mother's maiden name is also a common one.
When does it make sense to challenge the user with this? Or, what actions should be secured by a secret word?
I'm just not sure I know the security value of a secret work, what its intrinsic value is over a password.
Personally I would never ever use any of those questions to reset a password. You are actually making your password scheme more vulnerable as finding out secret questions with easy to find answers is not that hard.
Bruce Schneier had an an excellent blog post titled The Curse of the Secret Questions on this:
The point of all these questions is the same: a backup password. If you forget your password, the secret question can verify your identity so you can choose another password or have the site e-mail your current password to you. It's a great idea from a customer service perspective -- a user is less likely to forget his first pet's name than some random password -- but terrible for security. The answer to the secret question is much easier to guess than a good password, and the information is much more public. (I'll bet the name of my family's first pet is in some database somewhere.) And even worse, everybody seems to use the same series of secret questions. The result is the normal security protocol (passwords) falls back to a much less secure protocol (secret questions). And the security of the entire system suffers.
