Prof. David Gerhard says passwords should be long, easy to remember and not necessarily changed unless there is a breach.