because people tend to use the same usernames/passwords all over the place. Why? Because 1,000 sites demanded credentials. Chicken/egg