The vast majority of users worry about compromised passwords, but two-thirds continue to use the same password or a variation, a survey finds.