Short passwords are vulnerable - and by short, we mean 8-characters

[hazard]

Basically, when you are dealing with 'random asshole trying to get access to your account' it matters how long he has to spend cracking your password because he has no specific need for you in particular. In such cases having a long but easily remembered password works fine because he's unlikely to access your personal records and history for hints, he just doesn't care enough. For the time spent cracking you he can have a dozen or more others. When you are dealing with 'somebody wants access to your account specifically' though that goes out the window and a random password generator becomes more reliably difficult to hack. Because he wants access to your account, and if that means some more legwork... he does that legwork, or has it done for him.