Jasson Casey, Beyond Identity: “malware doesn't care if your password is four characters or four thousand characters long”