On a tangential note, I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge.
On a tangential note, I hate security questions. I do not understand the need for them, or how they keep anything secure, when the questions they asks are always public knowledge.
The dangerous ones such as this allow someone to use the security questions in place of your password. These are less secure than if you were to use your place of birth and address as your password.
Their thought process probably goes something like "we can't have users giving us their password over the phone, anyone could overhear that and they would think it is insecure. Lets have them give us something less confidential instead".
Services like this that require verbal authentication via the telephone should generate a passphrase and email it to their uses upon signup.
Any service that is sensible enough to give you that information will hardly make use of "security-questions" in the first place...
Like with most things, security questions create a facade of security. Just like the "at least one lower case letter, one uppercase letter, one number, and one non-alphanumeric character" requirement of some sites: more often than not, the resulting password is "easier" to guess (many people put the numbers at the end, etc)