You may assume that the original how_bad method does produce correct results.
Your goal is to refactor it: to make the code more elegant without changing the external behavior.
In terms of what Hannaldous' code does, a hint is that it has something to do with evaluating passwords.