Retirement plan advisers who are interested in online security—or at least in how to accommodate various website demands for passcodes of eight-plus characters including one capital letter, number and symbol—have likely heard more than their fair share of advice on building passwords.