A strong password isn’t the strongest security