“Criminals attempt to victimize our customers in various ways and we’ve found the vast majority of attacks are through […] and the reuse of passwords on third-p

“Criminals attempt to victimize our customers in various ways and we’ve found the vast majority of attacks are through […] and the reuse of passwords on third-party sites—none of which are helped by very long passwords.” I'd actually disagree with this assertion. If I can just prefix my insecure password (let's say "password123") with "Microsoft", it becomes both more secure, essentially distinct from the password on other sites, and easy for me to remember. If the limit is just 16 chars, then I can't do that.