[lawnchair_larry]

That risk level is not at all on par with this though. That won't help with filevault turned on, and it requires both a reboot and a physical presence at the machine. This can be done remotely with shell access, and discloses hashes from other accounts.

[caf]

In other words, it can be done remotely through a browser exploit.

[Locke1689]

This also won't help with filevault turned on.