Do we want to expose the username or length of password to the developer? They won't necessarily have access to the config file. We could be giving them new info.