Seems like the real threat here is training a user that it's ok to use third party web sites to tell them what password to use. That's a very bad habit.