A method comprising: presenting, to a user of a device, one or more content items identified as being familiar to an actual user of the device and one or more comparable items that are identified as being unfamiliar to the actual user of the device; receiving a response at the device from the user after the presenting; and authenticating the user based on the response, wherein the method further comprises: presenting a plurality of sets of the content items and the comparable items; receiving a plurality of responses from the user after presenting the plurality of sets; and identifying a number of correct responses from the plurality of responses, wherein the authenticating is based on the number of correct responses, selecting a plurality of content categories, each set of content items and comparable items corresponding to a same one of the plurality of categories, characterised in that: the one or more content items identified as being familiar to the actual user of the device are familiar to the user of the device as being content items stored on the device, and the one or more comparable items that are identified as being unfamiliar to the actual user of the device are unfamiliar to the user of the device as being comparable items not stored on the device. presenting, to a user of a device, one or more content items identified as being familiar to an actual user of the device and one or more comparable items that are identified as being unfamiliar to the actual user of the device; receiving a response at the device from the user after the presenting; and authenticating the user based on the response, wherein the method further comprises: presenting a plurality of sets of the content items and the comparable items; receiving a plurality of responses from the user after presenting the plurality of sets; and identifying a number of correct responses from the plurality of responses, wherein the authenticating is based on the number of correct responses, selecting a plurality of content categories, each set of content items and comparable items corresponding to a same one of the plurality of categories, characterised in that: the one or more content items identified as being familiar to the actual user of the device are familiar to the user of the device as being content items stored on the device, and the one or more comparable items that are identified as being unfamiliar to the actual user of the device are unfamiliar to the user of the device as being comparable items not stored on the device. presenting a plurality of sets of the content items and the comparable items; receiving a plurality of responses from the user after presenting the plurality of sets; and identifying a number of correct responses from the plurality of responses, wherein the authenticating is based on the number of correct responses, selecting a plurality of content categories, each set of content items and comparable items corresponding to a same one of the plurality of categories, characterised in that: the one or more content items identified as being familiar to the actual user of the device are familiar to the user of the device as being content items stored on the device, and the one or more comparable items that are identified as being unfamiliar to the actual user of the device are unfamiliar to the user of the device as being comparable items not stored on the device. the one or more content items identified as being familiar to the actual user of the device are familiar to the user of the device as being content items stored on the device, and the one or more comparable items that are identified as being unfamiliar to the actual user of the device are unfamiliar to the user of the device as being comparable items not stored on the device.