One question, why people always say that disabling passwords is important. AFAIK, passwords with keys is better than keys only. Now if someone gets the keys they can access the service with those keys without the passwords. Disabling passwords just makes security in one way worse. Think about chip & pin, because you have your credit card, wouldn't it be smart to disable PIN completely? Of course key ring could be encrypted, but that still allows off-line attack against it. If password is queried on-line, you can limit password attempts which you can't do in off-line situation. - Thanks