You are reviewing the functions of a self$-$service password reset system. Which element of it is the most significant security risk? Choose the best response.

a$.$

Users can verify their identities by requesting a password reset link to be sent to their email address.

b$.$

No password hints are displayed to a user who has not authenticated yet.

c$.$

Users can verify their identities by answering challenge questions such as their childhood street or the maiden name of their mother.

d$.$

Before users get a new password, they must enter the old one or verify their identity by other means.