American Express recently added these "3 questions" to my account, and it made me very mad. For one thing, their "request" was persistent; it eventually wouldn

American Express recently added these "3 questions" to my account, and it made me very mad. For one thing, their "request" was persistent; it eventually wouldn't let me log in until I provided them, so they were really a requirement. "For security", of course, even though there's evidence [1] they make security worse. To make it more insulting, though, I discovered that the implementation was very dumb: 1. The questions were fixed, and extremely stupid. Any of them could probably be guessed by someone with a few minutes to Google. 2. The question lists were too short, making it difficult to pick a really hard-to-guess answer. 3. The lists were unique to each question. So if I saw 2 questions I liked in the first slot, I could choose only one of them, and if the 2nd slot had completely inane options, I had to choose one of the inane options. 4. The last question didn't even offer options that applied to me. So suddenly, for "security", I had to remember which unrelated question I selected, and which made-up response I provided. Thanks a hell of a lot, AE. [1] http://www.schneier.com/blog/archives/2009/05/secret_question.html http://www.schneier.com/blog/archives/2009/05/secret_questio...