Whilst not a password panacea, using ‘three random words’ is still better than enforcing arbitrary complexity requirements.