Who is the dunce here?

On Twitter, Craig Schmuckatelli writes,

.@johnpodesta got hacked because he used "password" as his actual password and fell for a phishing scam, but Don Jr is the dunce.