We used to quip that “password” is the most common password. Now it’s “password1.” Who said users haven’t learned anything about security?