Well, for one, "cracking the password" in this case would take an attacker much longer than just going to find some other family's blog to creep on. And there i

Well, for one, "cracking the password" in this case would take an attacker much longer than just going to find some other family's blog to creep on. And there is no entry point for a directory listing (default page is being taken by the password prompt, no other directories are present), but if, for example, GitHub accidentally made my private repository into a public one, it's just a matter of changing a directory name to reset the password. The content being protected here isn't nuclear launch codes, it's just family pictures/journals--so we don't need rock-solid (and annoying to set up/maintain) security, but just a deterrent much the deadbolt on our house's front door.