Tell them to use a diceware/xkcd password. Memorable and secure (currently with 7 words or more).