A string is not that hard to remember when it is a password you thought up and have been using for 10 years. OK I cannot offer proof that most people would not

A string is not that hard to remember when it is a password you thought up and have been using for 10 years. OK I cannot offer proof that most people would not write down their password, but surely some would not - and for those people having a separate User ID/password combination represents improved security. But anyway this is beside the point, which is that adding random characters to user credentials improves security - whether those credentials are 1 or 2 strings - and would have prevented this TurboTax attack. Yes, using the haveibeenpwnd service offers some level of protection. But it still allows an attacker to breach a random website like funnycatpictures.com and find the email/password combinations that are not on haveibeenpwnd. Boom, that attacker has access to all those users' tax information.