I need to implement a password reset feature for a system that will be controlled by a security question and answer pair. The problem is that I can't guarantee I'll have a valid e-mail address or cell number for the account that I can use to communicate a reset link or code. This means the entire process will happen on the web page. I will have a known e-mail address for the user, but it's an address that was issued by the system in the first place, meaning the fact that someone is using this feature at all may imply they no longer have access to that account.
In this circumstance, it seems like the security answer effectively becomes an alternative password, in that knowing the Question (I plan on requiring you to select the correct question from a list, as well) and Answer for an account are the same as knowing the password. This makes me think that you'd need to have the same kind of complexity requirements for the security answer that you do for a password. However, I can't recall ever seeing this implemented. If I've run into requirements at all, it's usually something simple, like at least 3 characters just to make sure you put something verifiable into the field. They're also relying on the fact that send the code to a registered location in place of the additional complexity.
I plan to mitigate this by also sending an e-mail on completion, or when the session expires on failure, and by limiting the number of attempts in a given time frame. The system administrator has the ability to do a reset manually, without knowing the question/answer or original password, so I can't lose control of the account. But it seems like I'm still missing something. How should I handle this?