Millions using 123456 as password, security study finds