Schneier backtracks on the no value of masked passwords.