comp.security.passwords

What's the most overrated part of passwords?