Considering the data is already there at the point of authentication I think this is a great and innovative idea. Infinitely better than 'What is your mother's maiden name?' type questions.
The problem is that it's very vulnerable to attacks by people who know me -- they tend to have interacted with many of my friends. I wonder if Facebook deliberately chooses the photos from different clusters of people.
Exactly, good luck in keeping your deranged ex out.
Don't you have to successfully login before getting to this authentication step? So the people who know you would have to know your password first, in which case you're already vulnerable.
I don't think the data exists. In several images, I was supposed to identify a blank wall or a random object as a friend. Pretty sure they use this to tweak their face detection algorithms.