> They can be guessed – Regardless of complexity requirements, users will find and use the simplest pattern allowed, and attackers routinely take advantage. It

> They can be guessed – Regardless of complexity requirements, users will find and use the simplest pattern allowed, and attackers routinely take advantage. It's right in the article that they are talking about average user behavior of choosing guessable password, even if you tell them not to.