One problem with this is social engineering... someone could call the company to recover their password and say that they entered garbage for the security question...

I started to enter passphrases instead