Why the password “this is fun” is 10 times more secure than “J4fS!2”