From my own reading, security questions on websites seem to have a reputation in the industry for being outdated and insecure, the basic information they need being easily available to anyone who can Google, unlike in the '80s when they were first developed for the banking field.
However, it occurs to me that a huge part of this has to be due to the fact that most security questions are canned and re-used on virtually every site that uses them, thereby hugely narrowing the list of potential answers. Surely, giving users the option to create their own custom security questions with custom answers would solve this problem? I know I'd be a lot more likely to remember an answer to a basic question I devised myself, and a hacker is less likely to be able to find out what my favourite car is than my mother's maiden name. So why isn't this common practice in the industry, and why do web apps insist on using the same canned questions?