Banks have been careful not to put too much on the end-user. Look at PIN codes. We had four digits. People in the data-security world said that four digits are not secure because they are easily compromised by random number generators, and users would probably use years and birthdays. Then why did banks do that? Because four digits is the least common denominator that the public won't have to write down.