One password for the whole company, another '12345678' for the bank. Here's why it's dangerous, and the simple habits that really protect you.