Hackers don't break in. They log in. Here's the founder's field manual for not handing them the keys.