Right, and that default should probably be changed.

But that doesn't justify this clickbait title which is simply untrue as nowhere in the report does it say that passwords are shared "everywhere."