Risks Posed by Legacy Authentication