Decoy password vaults: At least as hard as steganography?