They should be unless you want to publish one of the things that too many (eg sites) regard as a reasonable secondary security verifier.