> My wife filled one out a few weeks ago where both the questions and answers were selected from popup menus

United Airlines does this.

Their reason is incredibly depressing.

https://mobile.twitter.com/evacide/status/711853927134842880

Infosec is an unsolved problem in so many ways, especially for the majority of people that are nontechnical.

I can't reply to the sister comment for some reason, so I'll piggyback on the parent.

I always fill these with awkward or absurd questions/anwers that would be amusing if a human operator ever needs to verify them. E.g.

Would you like to go on a date with me?

What color pants am I wearing?

What is the square root of insanity?

Obviously you need to store these in a password database in order to remember them, which kind of defeats the purpose. If I have to choose from predefined questions, it goes along these lines.

Q: What was your mothers maiden name?

A: Why, are you stalking her?

Q: Where were you born?

A: Oh I can't remember, it's been so long!

I've just started filling them with randomly generated strings that my password manager helpfully creates for me. Though, apparently my bank uses those answers for phone verification also, which makes answering questions like "What's your Significant Other's nickname?" awkward when the answer is "F9-#g7a2<qj"

I do the same, but Correct Horse Battery Staple them.

Yep, that's the way to do it - just ignore the questions competely and let your password manager handle it.

Use a random but user friendly value

#$%&+@ is going to be hard to type or speak, just say their nickname is "the frozen one", same entropy, easier to handle

>> What's your Significant Other's nickname?

> Use a random but user friendly value

> "the frozen one"

I imagine that may make make your significant other who was previously friendly, markedly less so, if they see your "friendly value". But that may have been your point, as it may be quite a bit easier to remember. :)

My point is to use a term that is easier to type and speak rather than just a sequence of symbols. Or just modify the "right" answer in a quirky way.

But yeah, what you said might happen.

Error: Security question answer cannot contain special characters: !@#$%^&*()';

Error: Security question answer cannot be more than 10 characters long.

Error: Security question answer must be one word.

Error: Security question answer must be unique.

Error: Security question error. Please try again.

Best way to handle these are to use a random string for all the answers if you can, and if they let you create your own questions use more random strings; same goes for login names.

What city was my dad born in? xGU,wT&Yvcn6vr?]#,mE of course.

Until someone says "I know my dad was born in Minneapolis, what does it say??" and the customer service representative replies "Huh, it looks like the answer is just gibberish...", "Ah! I must have just mashed on my keyboard when I made the account, sorry about that!!", "No problem, your password is now reset to foobar".

While avoidable with training, that brings up its own issue: What if what's being asked of the people taking these calls is outside their pay range?

I think all account credentials related things should be handled by special support people, who were trained to understand the situation. Shouldn't be that big percentage of all requests when people need to change/remember password and can't use regular ways.

Then the company's decisions on how much to pay their call centre staff has just opened up a possible vector for attack. Simple as that.

I did that to my payroll account to try and prevent this very issue.

Little did I know that it's one of those services you need the password (I had written that down at the time as it was temporary) AND these questions that are usually used for password resets.

I don't think that will ever get fixed until I change jobs again.