I agree with the point that secret questions suck, but the entire idea that any sort of second password as high-security is flawed. Daily WTF did a great write-

I agree with the point that secret questions suck, but the entire idea that any sort of second password as high-security is flawed. Daily WTF did a great write-up (http://thedailywtf.com/Articles/WishItWas-TwoFactor-.aspx http://thedailywtf.com/Articles/WishItWas-TwoFactor-.aspx) on how real two-factor authentication requires two distinct forms - one based on what you know, and one based on what you have. Historically the "what you have" has been one of those RSA tokens but now Google is doing some two-factor using phones and it's easy to do this using text messaging as well (as someone mentioned). With this availibility of cheap RSA devices and cell phones, I see no reason why institutions such as banks - where I really care about the security of my data - can't implement the same measures that Blizzard does for World of Warcraft.