PasswordStats: weakness_factor()