People only realize the need for a stronger password when there's a breach. But often, by that time, it might be too late.