As few as three random words make better passwords than strings of random characters -- but not, perhaps, for the reasons you think.