Right, but my context is that devs often use no passsphrase at all. If someone can get a copy, they have instant access to whatever it has access to.