Security red flag: passwords are "secure enough."