“One of the characters of your chosen password was used in the same position 12 password-changes ago, but I won’t tell you which”