Protected by rate limiting. Passwords are hashed with scrypt and never stored in the clear.