My (non-technical) family members keep using their birth dates, phone numbers etc as their passwords. I told them this is insecure, that they should use long random passwords, but their response is "I can't remember that". So I suggested writing it down, but they find that too much hassle. I managed to convince them to do it for some passwords, but they keep losing the paper (they just tuck away the paper somewhere and then forget where it is). Furthermore, they don't have computers, they ONLY use mobile devices, on which long passwords are awkward to type. So they revert to using phone numbers and passwords, with the attitude of "I'm not an important enough target, and if a hacker really targets me I am screwed anyway".
Some of them have difficulty grasping the concept of multiple passwords. To them, it's just "the Internet needs a password". If I explain to them that each website is a different vendor, they get confused. Just remembering which login username to use for a specific website (or whether it is a username or an emailaddress-as-a-username) is already difficult enough for them.
Mind you, we are talking about people older than 45. They have trouble using computers (even phones!) as-is, even before we get to the security part.
I ended up becoming their password store for their most important accounts. I setup random passwords for them, then when they need to do something (a few times per year) they have me login and do it for them.
The average user doesn't care enough about online security to really do something about it. They don't understand, or acknowledge, the risks. So we need to do everything we can to make security convenient.