The use of DOB as an element of security has always made me question its use as an element of security. It's used in many places, is not typically considered confidential, and is relatively easy to look up in publicly-available information.

Lots of security conventions ("mother's maiden name" for another example) are very silly.