If your profile is up to date: why are you including password reuse attacks in your threat model?