I agree, for the most part it is kind of overkill. For example, our version control is password protected, but you could just walk in (door's not locked most of the time), take a hard drive from a computer, pop it in another computer and get access to almost current code as everyone has the code checked out anyways. (Though, this stops you from committing as someone else, which is probably a good thing.) But besides access to proprietary code, having access to my account won't give you anything of real value...worst you could do is send some emails as me, or submit a bug to the bug tracker (so dangerous! ;P ). So I really don't see a point in having that much security on my account. What makes this more annoying is just trying to think of a password that is complex enough to meet requirements, while still being able to remember it, so I don't lock myself out of my account from too many wrong passwords. :doh: