But Passport, which stores personal information on Microsoft's servers, still lets customers use wildly insecure passwords like "password, " and lets anyone who knows your zip code take several cracks at guessing the personal "secret question" that resets the password.