You can apply any appropriate security policy to the GetPasswordHashAlgorithm Web service. As this service is used in conjunction with the LoginUser service, it is suggested that you use the same security policy for both.