The median user's password is guessable, reused across dozens of sites, and likely to be on multiple data dump lists.