Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking wo

Possibly. I've been on phone support with companies that require me to tell them answers to my security questions. Also, automatic security question checking would require support for soft matches like capitalization or punctuation. You could simplify the data before hashing (strip special chars and convert to lower case), or store multiple hashes to each variant. I really wish a lot more work went in to security question penetration testing. It's relatively easy for a determined attacker to come up with the correct answers to these questions (or convince a human that they know the answers). The recent iCloud breach makes me believe that in many cases the "security questions" practice is by far the weakest link in modern web authentication.