Passwords can sit on hard disks for years