> You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions. Google, too. I suggest you run

> You should submit this together with a security issue report to Facebook and Hotmail and whoever else uses security questions. Google, too. I suggest you run through the recovery process yourself (on a dummy account, or your own) to see the kinds of questions asked. Questions like "when did you last access the account?" are easily answered; as is "name 5 regular contacts"; and so on. I could (but would not) perform the recovery process (and gain access to) acquaintances accounts, given how simple the questions are. The key is just knowing "enough" in aggregate to pass their bar.