Entertaining (though I've already read this one...). I have a more interesting game I play with bank security questions that's more useful, though -- and appli

Entertaining (though I've already read this one...). I have a more interesting game I play with bank security questions that's more useful, though -- and applies to the most common usage (where the bank provides the question to you). Simply this -- for each question, imagine how easily you could guess the answer even knowing nothing about the account owner. I'm not talking about real analysis here, just roughly mapping out the answer space. For example, "In what city/town did ___?" is a common question. Well, if it's a US bank, probably you're dealing with US cities, and there are fewer than 20K. (Already, whoa: a three character alphanumeric password has 10 times the possibilities). Then of course cities should be weighted by population, so since NYC is biggest... well, New York has 8.3 million of the USA's 311.6 million population, the answer to this question will be New York City about 2.6% of the time. "What's the first name of your [specified grandparent]?" is another good one. How diverse are first names, generally, particularly a few generations back? Of course there's a long tail, but otherwise... not that diverse, and it's trivial to find stats on most common names in the early 1900s. I've never chosen this question even before I started thinking hard about security, because it was blazingly obviously a bad question -- the banks would ask for my maternal grandfather's name, and I was named after him. Fun, no?