Government investigation puts spotlight on password insecurity