So the original security model was to ask the user for an email address, at time of account creation, and if they forgot their password the system would email a new password to this email address.
The idea now, however, seems to be to use security questions more. So if I forget my password, the website asks me "What is your pet's name?", I type in "chuck" and then the website prompts me to provide a new password and lets me in.
The security questions model seems much less secure to me, as a dictionary attack could be more effective against it.
Why are we "ok" with security questions, as this seems to bypass our requirement for secure passwords?