I suppose with a friend or family member I'd tell them to ask me a question that we both know the answer to, but no one else would.

That's what online auth is fundamentally trying to do, isn't it?