Passwords are inherently valuable, imo. The more knowledge you have about a person's password habits, the easier it is to crack other services as well. Witness

Passwords are inherently valuable, imo. The more knowledge you have about a person's password habits, the easier it is to crack other services as well. Witness LinkedIn: https://community.qualys.com/blogs/securitylabs/2012/06/08/lessons-learned-from-cracking-2-million-linkedin-passwords https://community.qualys.com/blogs/securitylabs/2012/06/08/l... I'd be willing to bet very few people use truly unique passwords across all their accounts. While personal responsibility is paramount, human nature is what it is, and (again, imo) all sites that require authentication should do it well (over SSL).