When I talk about security, the question I like to pose is this: Imagine every password for every one of your users is published...can you identify people? How

When I talk about security, the question I like to pose is this: Imagine every password for every one of your users is published...can you identify people? How would you clean up the mess? Imagine a malicious person logged into EVERY one of your user accounts and tampered with them, changed email addresses, etc. Can you identify it? Can you clean it up? Can you prevent it from happening again? If the answer to any of those is no...then you're sitting on a time bomb. Start with the assumption that the username and password is convenient but unreliable, then move forward with actual security.