We already know that most users' clever passwords aren't protecting them from hackers. It turns out that the complex password requirements most sites ask you for aren't doing as much to help either.