Embed Notice

@chetwisniewski @boblord
1) do not use security questions. :)
2) if you use a pwd.manager, use that to generate & remember random pwds as answers to security questions
3) if a service provider uses security questions, tell them to stop using them.
4) Recommending them a little bit of MFA, in particular WebAuthn/passkeys, is a good idea.
5) Tell them using security questions is close to negligence, if not gross negligence, of recommended practices & standards today.