> They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.)

I'll never understand why someone would provide this information to Facebook. My friends already know the details of my life relevant to our relationship.

Not that it excuses this so-called security, but for the insecurity question, you could just lie. Only problem is, then you have to remember your lies.

That was another point I meant to raise. Even if your password policy and weak-password checks are sane, if your account recovery procedure is weak, there are still planet-sized holes in your security perimeter.

And for any large system (say, Facebook, with, oh, nearly a billion accounts), user support requests (many of which are access related) are a huge cost. It doesn't take many of these to eat through $2-$5/account/year value they're seeing.

My bank upgraded from a 4-digit pin code authentication to a 6-letter ([a-zA-Z0-9]{4,6}) system. About legacy databases ...

Naturally, I complained and they told me it wasn't that big of a deal, because the actual transactions were protected by TAN generators. I had no answer to that.

Oh god, PIN codes... Two years ago my girlfriend and I had to go to our banks and get cash. Luckily they're right across the street from each other, so we walk in to mine first. I go to the ATM, tap in my pin, do my thing and we move across the street. I'm standing by the door while my girlfriend goes to the machine. I'm still fiddling with the receipts in my pocket and whatever when I hear something. The ATM, plastered in signs to cover your screen, not let anyone see you putting in your pin, etc.– was calling the tones on the speaker. Anyone who cared to listen could hear her pin. I've yet to encounter another machine that does that, but man– if I ever got a hold of the who decided that a 4-digit pin was a good idea for security there would be quite an unpleasant exchange...