@freemo My favourite was when the European Space Agency rolled their own security questions on a new satellite data portal a while back. The questions were a mix of changeable answers ("When did you last water your plants?") and yes/no answers. The minimum field length was three characters.