Since this check is currently done _unencrypted_ (as lapcatsoftware said in his post), I'd say it's objectively bad.