Why Hiring Criminals for Passwords Is a Dangerous Trap