passwords should be like “that’s close enough”