It seems similar to a personal challenge question like "What is the name of your High School". Your face is public information, just like that knowledge, but can be used in a security process to statistically decrease security breaches.