They do, it's referenced at https://blog.codinghorror.com/your-password-is-too-damn-shor... which linked in this post.