More than 23 million people have ignored the advice of security professionals, using easily hackable and insecure passwords such as "123456" and "password" to protect their online accounts.