>They should be treated as such by users (generate random responses) and devs (hash and salt them).
I agree for tech savvy users it's prudent to treat them as passwords, but it doesn't extend to the general public. If they should be treated as passwords, what's the point of having them then? They're most often used in password reset flows. If it's a random string/phrase, they're basically useless in that use case. In what situation would you have the randomly chosen string for the security question, but not the randomly chosen string for the password?
I agree for tech savvy users it's prudent to treat them as passwords, but it doesn't extend to the general public. If they should be treated as passwords, what's the point of having them then? They're most often used in password reset flows. If it's a random string/phrase, they're basically useless in that use case. In what situation would you have the randomly chosen string for the security question, but not the randomly chosen string for the password?