How come it’s still possible to ‘secure’ an online account with a six-digit string?