Fixed security questions just seem like a flawed idea anyway. When creating an account to access a significant financial service online recently, I was given a

Fixed security questions just seem like a flawed idea anyway. When creating an account to access a significant financial service online recently, I was given a list of some 20 security questions and asked to choose 3. The problem was that 18 of them didn't apply to me or had no clear answer of the kind that I would certainly remember in the event that those questions were actually needed to prove my identity. These things are probably second only to using SMS-based 2FA for annoying security measures of questionable effectiveness being mandated by ever more services (though the new voiceprint-based 2FA is closing fast).