We're still making terrible choices with passwords, even though we know better