Creating Passwords: Expectations vs. Reality