Many ‘password challenged’ internet users don’t take steps that could protect their data