Most sites just send password reset info to your email. I thought these questions are usually used just as an extra layer on top of that? So someone would need to hack your email and guess your question, which makes it less of an issue if you keep a secure email account.