And for a lot of "low-value" targets, this is still a completely reasonable suggestion. It _is_ demonstrably better than shared passwords or easy-to-guess passwords.