You Might be on position re: data leakage and This could be a crucial consideration for any person rolling their particular authentication/authorization scheme. +one for mentioning OWASP. Anything at all that can be effortlessly guessed is not Secure as a password. We've discussed each of the elements of hacking, its http://pigpgs.com