What about Hotmail's "eh" flaw of 1999? I'd say a two-letter password is practically "zero auth".