This is likely to be a unique password actually, because it's relevant to the service the user was logging into, and it's only 5 chars (many website would not e

This is likely to be a unique password actually, because it's relevant to the service the user was logging into, and it's only 5 chars (many website would not even accept it because it's too short). I am just saying that every other week there is a new blog post with password analysis of leaked passwords: how many are 123456 and blah blah blah. I think it's time to cut some slack to the users and start blame HEAVILY whoever is taking care of the system or programming the service. (BTW: you'd be better off using supergenpass or stanford PwdHash)