You can pick a password in proportion to the threat. A short password is sufficient to thwart "casual attacks" (someone snooping around by accident). You can in

You can pick a password in proportion to the threat. A short password is sufficient to thwart "casual attacks" (someone snooping around by accident). You can increase the entropy of the password as needed to thwart arbitrary compute. (Although to get enough entropy you'd probably want to generate a GUID for a password, write it down, and don't lose it.) What I'm trying to say is that your company wasn't necessarily being stupid.