If you're using passwords as an authentication methods then you've already lost.