I like doing it to corporate security folks after they try to dictate it in authentication systems. They usually seem to understand after it's done to them.