That's true, although I do hash my answer with a domain-specific secret, I should have mentioned that. If at all possible, however, I don't fill out the secret

That's true, although I do hash my answer with a domain-specific secret, I should have mentioned that. If at all possible, however, I don't fill out the secret question. There are actually a good amount of major sites that let you skip that step. I'd rather just be locked out if I forget the password, than have that be another vector for taking over the account.