How to Answer Security Questions Securely