For secret questions, I always use output from /dev/random (at least 1 kilobyte) and base64-encode it, then throw it away. Secret questions are just too weak fo

For secret questions, I always use output from /dev/random (at least 1 kilobyte) and base64-encode it, then throw it away. Secret questions are just too weak for anything, they're useless.