Am reinstalling Windows 10.
Dang. It forces me to provide no less than THREE security questions. I have to choose them among questions like, What was the name of your first pet and What city were you born in.
OK Windows might do this to convince me to use an online account. But it's not just Windows. There are MANY more examples. Last non-Windows example was the game Realm of the Mad God. And one more, perhaps the weirdest example: management account for my ISP (this includes viewing bills).
I fail to see the purpose of such questions. They ask to provide info that is, in case of most people, easily researchable. (I like to delude myself into thinking it is not in my case, but I wouldn't bet a penny on this). Even if it's not, the answers to such questions are easily brute-forcable (What was your mother's family name? Just check all most popular family names).
I'm a layperson in terms of security. So I may be wrong. But to my little brain, providing answers to these questions (and hence: asking the users to provide such answers) greatly weakens security instead of strengthening it!
And there come the issues of users who forget the wording of their original answer... Title of your favourite piece of music? Many titles can be stated in many ways. Or forgetting the actual answer... Name of your favorite childhood toy? Did I have one? Or even, the aforementioned favorite piece of music? This can change.
Does this practice improve security in any way? If not, then why do so many websites, so many products, so many companies force their users to provide answers for these questions?