On security questions. Companies that require these are deluding themselves into thinking they have "additional security" for their users.