Get creative: The average US user recycles online passwords at least four times