RE: #1 - with every site requiring passwords even to post
comments, I don't consider most passwords to be 'sensitive'
data.

RE: #2 -what law requires you to provide your real mother's
maiden name, city of birth etc for those requests?. I know
that most people instinctively answer honestly; I found it
easier to craft an alternate identity for that purpose.