It's not what you know, but who you know: a social approach to last-resort authentication