But that's a much much smaller target to aim at than the vast number of websites that you trust with a password