> Or, is it simply that people don't choose random, long passwords?

That's always part of the problem.