Why it’s hard to change risky habits like weak passwords and heavy smoking, even when advice is clear.