static password flaw