there should be some 'best practice faq' for fossil then, because if i store the same username/password in my local repository as is in the remote repository, then compromising my local also compromises the remote.  also, i assumed that fossil was storing a hash of my password, so i chose a password that i use frequently on the internet.  so, now that you know what that is, please don't drain my checking account.