Standard password security, basically. At that point, there's a lot more danger from social engineering or people writing down the (long, non-obvious) passwords.