This is dangerous nonsense. Lots of people are going to conclude from this that they don't have to use complex password, avoiding dictionary words and symbols. But despite the headline- this is *not* the fundamental conclusion drawn in the paper. The subtlety is in the fact that they keep saying "user-generated and memorable". The headline might as well read "humans are terrible at judging whether something they create is complex and random"