Weak Passwords, Are Users Really to Blame?