> the Q&A was never good security in theory The 'security questions' were never about 'security' (at least not directly). As you say, they simply created a "b

> the Q&A was never good security in theory The 'security questions' were never about 'security' (at least not directly). As you say, they simply created a "backdoor". They were always about: "automated forgotten password recovery". As in, the companies did not want to employ telephone workers to handle the inevitable "I forgot my password, can you let me back in" calls [1]. They were only ever meant to allow for "reset password" via 100% automated means". That's why the questions are often so much of a sort of "ok, anyone who knows X, or does a little research on X, can figure out that answer" type. They were just that way because that also (hopefully) meant the "I forgot my password" users would not also forget their "recovery question" answer. [1] Or, much more likely, bean counters realized that the call center size (and expense) could be reduced by 87.4% if we (bigco X) implemented a way to automate handling all those "I forgot my password" callers.