[cliveowen]

You're not supposed to put in real answer anyway.

[personZ]

This sort of comment appears a lot and it makes for an easy trip to victim blaming.

Apple created these questions for you to enter real answers. They fully intend for you to put in real answers. That is what the system's purpose is.

That we look at it and say "well that is grossly insecure, so I'm going to put in the SHA512 hash of the question with a fixed secret salt" might assuage our risk, but it does nothing to relieve Apple of the failure of this security system.

[AlexandrB]

Not only is it insecure, but in some cases intensely user unfriendly. I used to put real answers in these until I realized even if I remembered the answer I could never recall the exact string I used.

A common example: "Name of first car?"

So was that "Neon"? or "Dodge Neon"? or "Blue Neon"? or maybe "neon"? or "1991 Dodge Neon"?

Security questions are basically a secondary password masquerading as something else. But because they are not called a password, the expectations on their character-wise-correctness are not clear to a layman. I find the continued proliferation of security questions baffling, especially when some sites call password + security question "two factor authentication".

[cryptoz]

I usually use an answer like securityquestionsshoulddieinafire [1], no matter the question. Easier that way, and more satisfying.

[1]: No, not that exact string ;)

[samspot]

it works until they limit your to 10 characters, now you have an exception you will never remember!

[electromagnetic]

I usually switch the answers around. So A gets B's answer.