Agreed - but it's still good policy for sites you care about. For me, that would be the ones where I might lose money if someone nefarious logged in as me. Those get changed.