I feel there ought to be some much-more-secure option, but it probably involves a level of client-side computation that the average person won't do on their own.