Why a “secret” answer may not stay secret
A security question is a form of knowledge-based authentication: the service asks for information it expects the account holder to know, then treats a matching answer as evidence of identity. It became popular because questions such as a parent’s name or birthplace seemed memorable and offered a way to get back into an account without a password.
The weakness is that these answers often describe facts rather than secrets. Family relationships, old addresses, schools, and other biographical details can appear in public records, social-media posts, or data gathered from earlier breaches. An attacker may also learn them by guessing or by impersonating someone to obtain information. A correct answer can therefore open the recovery route even when the attacker does not know the password.
Treat recovery answers like passwords
The underlying problem is not simply that a particular question is bad. People tend to choose answers that are easy to remember—and those are often easy to infer or discover. Reusing the same truthful answer across services makes the risk worse: one exposed answer may help unlock more than one account.
If a service requires these questions, a safer approach is to use an invented, unpredictable answer and save it in a password manager, just as you would a unique password. Where available, use stronger recovery options, such as a verification method tied to a device you control or a saved recovery code. That changes account recovery from a test of personal trivia into something an outsider is much less likely to know or possess.
