It's a matter of scale. If you or I individually have a moderately clever and determined local enemy, with access to an average garage toolbox and some commodit

It's a matter of scale. If you or I individually have a moderately clever and determined local enemy, with access to an average garage toolbox and some commodity PC accessories, who is not afraid of legal consequences for stealing your information...it would take a lot less than $500 to get your information. The difference, and the reason this exploit is a big deal, is that a huge swath of our economy and society is in The Cloud. There are extremely, extremely clever enemies who (like our local hypothetical) are unafraid of legal consequences, because they're protected by online anonymity and possibly thousands of miles of open ocean and countries without extradition treaties. But they're not determined in the slightest! If it takes 60 seconds or costs $0.06 to break your unique configuration it's not worth it to them. It doesn't concern me that my coworker has a coffee cup in their desk drawer that contains sticky notes for some of their most important passwords. By the time there's a human being inside our building digging through desk drawers, we've pissed someone off far too much for that to be the weak link. I am concerned that said coworker does not use the same password on their pizza delivery app as they do on our work accounts, because it's only a matter of time before the former suffers a leak of ten million plaintext password-email combos, and tries pointing automated ransomware at all of the associated domains.