As always, weakass passwords are not much better than no passwords. Should be common sense by now. Enforce a policy against that.