My favorite thing is when the answer to the security question is allowed to be remembered by the browser, meaning anyone who gets my password can saunter up to any computer I've used in the past and bypass the stupid security question.