The problem with these things goes beyond questions with shifting answers or low entropy (really, how many answers to “what’s your favorite color?” are there going to be?). It’s that most of them actually weaken security.

Example. My online banking password is over eight characters of what should look like gibberish to anyone but me, with uppercase letters, lowercase letters, and punctuation. Fairly secure, right? We’re always told not to use English words for our passwords, and rightly so. Then why build a way to change that password by merely answering a question that (a) will almost always be an English word and (b) gives a big fat hint what that word will be?

I avoid the security questions whenever possible, and give gibberish as the answer when I can’t. I haven’t been locked out of a system yet because of it, and I haven’t had an account compromised by somoene who was able to guess that my favorite color is blue. Or is it red? I can’t remember.