More than 90 percent of user-generated passwords were vulnerable to hacking in 2013, according to a new report from consulting firm Deloitte.