What Hackers Don’t Want You to Know about Identity Management