Easy-to-guess passwords like 123456 remain in use despite repeated warnings, according to a senior UK cyber security chief.