Good point. It's worse than email or username.