Banks are especially bad. I know one bank that has you memorize 7 digits access codes and for authentication asks 4 digits at random places each time.