My wife filled one out a few weeks ago where both the questions and answers were selected from popup menus. One of the questions was "What's your favorite summer activity?" Her answer was, "Swimming." Yeah, that's going to add about one bit of entropy to most people's accounts, you idiots.
Another favorite is "middle name of your youngest child." That answer can change over time!
United Airlines does this.
Their reason is incredibly depressing.
https://mobile.twitter.com/evacide/status/711853927134842880
Infosec is an unsolved problem in so many ways, especially for the majority of people that are nontechnical.
I always fill these with awkward or absurd questions/anwers that would be amusing if a human operator ever needs to verify them. E.g.
Would you like to go on a date with me?
What color pants am I wearing?
What is the square root of insanity?
Obviously you need to store these in a password database in order to remember them, which kind of defeats the purpose. If I have to choose from predefined questions, it goes along these lines.
Q: What was your mothers maiden name?
A: Why, are you stalking her?
Q: Where were you born?
A: Oh I can't remember, it's been so long!
#$%&+@ is going to be hard to type or speak, just say their nickname is "the frozen one", same entropy, easier to handle
> Use a random but user friendly value
> "the frozen one"
I imagine that may make make your significant other who was previously friendly, markedly less so, if they see your "friendly value". But that may have been your point, as it may be quite a bit easier to remember. :)
But yeah, what you said might happen.
Error: Security question answer cannot be more than 10 characters long.
Error: Security question answer must be one word.
Error: Security question answer must be unique.
Error: Security question error. Please try again.
What city was my dad born in? xGU,wT&Yvcn6vr?]#,mE of course.
Little did I know that it's one of those services you need the password (I had written that down at the time as it was temporary) AND these questions that are usually used for password resets.
I don't think that will ever get fixed until I change jobs again.