Excellent observation. This brings up another good point which revolves around persona and site vulnerability. Do I want to use the same password, security question responses, user ID, etc. across all of the business, banking and social networking sites that require authentication? If someone hacks one of the more vulnerable sites and gets my user ID and password, chances are they could access some other sites as well. Do I want a different user ID for every social networking site? No, that makes it harder for people to find me. So, do the business Steve and the social Steve share the same user ID & password? No. Do they share the same mother's maiden name & birthplace? Yes. And that is a problem. Can I remember what I use where? Barely.

And then there is the whole issue of password strength... I cannot remember a combination of one cap, one special character, four letters and four numbers for one site, let alone 10, 20 or 30. And God forbid I use a password manager that gets hacked. Perhaps it is time to use our ubiquitous webcams and use a combination of voice and facial recognition software to replace all the silly questions and passwords.

I couple thoughts on the thread, which raises nothing but reasonable concerns.

• With security questions I always use the same answer no matter what lame question I choose.  The asking system doesn't know the difference anyway.  In effect, these personal questions become an "Alternative password, please?" question.
• As for SteveE's points, what I've done is create a series of cascading passwords and supporting personal accounts (think of onion peeling). 
  • At the center is the one account I use to access my actual money (aka my bank accounts).  This account has a single e-mail, a very cryptic password and username. 
  • Beyond that I've a separate username, e-mail, and password; this is used for other important accounts - credit cards, investments, online trading, etc.
  • Then there's another username, e-mail, and password for even less important things.  This pattern continues until I've a throwaway hotmail account and username with a ridiculously easy to remember password that I use for things like trying out new sights, downloading whitepapers, etc.

I'm not sure if either is very secure, but it makes me think it is...

Although I tend to use the same login and password for the many opt-in email subscriptions I have for work, I have so many others for more important, personal accounts, subs, etc., I keep them in a file that's protected (sort of) and violates all the principles of keeping that stuff secure. The file now prints out at 7 or 8 pages. I print it out once in a while to make sure I have it in hard copy. Good thing, too, because recently I inadvertently deleted the entire contents of the file.

What I like now is that some financial institutions and, of course, Intacct, require you to change them periodically . . . And, finally, in violation of every security principle, I have Firefox save some of the login / password combos so I don't have to remember anything.

I am password-protected but by no means secure  . . .

Tim B