Want a strong password? You're probably still doing it the wrong way

Security agencies says that three random words can be a better approach than enforcing complexity to achieve account protection.