Secret questions are extreme bad security practice. They're essentially a way to trade off a large amount of user security for reduced customer support costs. I

Secret questions are extreme bad security practice. They're essentially a way to trade off a large amount of user security for reduced customer support costs. It's the same as telling your users to pick a weak password (one that's very likely to be in a dictionary) and then give the attacker a hint what it is. On top of that, many providers (apparently Blizzard included) do not treat the answer to the security question as carefully as a password, e.g., they store it in plain text.