How difficult is it to configure this? Users should definitely choose passphrases of sufficient length and sufficient types to be secure. This is unfortunately an infamously tricky area of security to get right.