What characterises a knowledge-based authentication factor ("something you know"), and what are its weak points?

It relies on a secret that only the subject knows, typically a password or PIN; its strength rests entirely on that "only".

Knowledge factors are popular because they cost nothing, need no device and can be changed at any time. But the requirement that only the subject knows the secret is fragile:

• Guessing: people choose memorable, therefore predictable, secrets; attackers try common passwords online or crack stolen hashes offline.
• Disclosure: a secret can be told to a colleague, written down, observed while typed (shoulder surfing, cameras, keyloggers) or tricked out of the user (phishing, social engineering).
• Reuse: the same password at many services means one leak opens them all.
• No proof of exclusivity: unlike a stolen token, a copied secret leaves no trace. The owner still "has" it and may never notice.

Security questions ("mother's maiden name") are an especially weak variant: the answers are often public or guessable, and NIST no longer accepts them as an authentication secret.

Go deeper:

• Knowledge-based authentication (Wikipedia) — static and dynamic KBA and why it is easy to defeat.
• Password Cracking (Computerphile, YouTube) — how fast predictable passwords fall to a cracking rig.