Easy-to-guess words and figures still dominate, alarming cysbersecurity experts and delighting hackers.