[ncallaway]

Security questions are typically stored with a reversible encryption so they can be used by CS agents.

Security questions are not a password.

[MereInterest]

Which is why security questions are a horrible idea. What good does it do to have your nicely salted and hashed password when the answers to the security questions are available in plain text and get you access to the account.

[tinus_hn]

They are just equivalent to a password, as knowing the answers allows you to reset the password.