security questions as a recovery mechanism are fucking terrible. most people are going to fill in the same response for their security q/a over multiple sites

security questions as a recovery mechanism are fucking terrible. most people are going to fill in the same response for their security q/a over multiple sites so pretty much any bad actor in any organization could possibly look at the security q/a, guess that their question/answers are the same on other sites and exploit that avenue. also fuck remembering all of that. but i think hsbc was even worse than what united is asking for. for their online banking you had to enter in your password then enter in another password using a browser based keyboard (AVOIDS KEYLOGGING!) and then answer a security question or something like that. i must have asked for a new passcode to reset everything every couple of months (they mail these to you via snail-mail). of course the problem with the system was (and i forgot exactly how) there was a way sometimes to reset all these systems so you didn't have to remember your answer for each security measure. i was pretty sure it was a bug with the system but fuck if i want to endure the hell in trying to explain to a website with terrible security that you've found a bug in their terrible system and please don't put me in jail and what do you mean, 'what is a hash function?'