my concern here is less on the password effectiveness, and more on the underlying whys