How do I reset the BIOS password?

To answer the question if it can be cracked easily anymore: NO. Hasn't been viable since HaswellxBoot Guard killed the infamous workaround we employed since the 390E; so anything with a 40 designation (e.g. T440, Haswell P series) or newer is a no-go. The motherboard has to be swapped unless you can somehow dump the BIOS; and decrypt it without marring the code such that it changes the private key (verified by Boot Guard) blocks the bootup process and hoping against hope the TPM/security trip doesn't throw the death blow 0192 tamper error (this is nearly unfixable; some old models may be workable but forget about it on the Boot Guard generation due to Intel). They really secured these things down, cryptographically and physically.

Lenovos never had a backdoor password but practiced security theater for nearly a decade where if you could find the ATMEL chip and short SCL and SDA together quickly, it bypasses the password so you can remove it but you had to go into the BIOS immediately to wipe all of them out for it to persist. This is because Lenovo stores it in the NVRAM on the new ones, not a dedicated chip. This is in contrast with the old laptops that stored it in the ATMEL chip; this is why anyone with the knowledge can get the job done in minutes. This was in contrast to consumer-grade laptops which used CMOS RAM for decades so it was much easier. You need to reflash these new Lenovos with a clean BIOS (read on for more info) to clean them up.

On the business models (ThinkPad) with older models like the XX30, the solution was to find the ATMEL chip and short 2 lines, or use an HW tool to do it (sold by an Australian); even this no longer works on the newer Think laptops (XX40-present) with the POP being in the protected NVRAM as well now. It's a motherboard replacement for both the consumer and business system unless you can get Lenovo to reflash both the BIOS and EC firmware (or get a clean dump, do it yourself, and program the information to the motherboard yourself). This is in addition to needing to do an NVRAM wipe if the password and BIOS are stored in separate spaces. Lenovo denies this can be done and makes you buy a motherboard when it can be done by wiping and reflashing the EC firmware/NVRAM and BIOS EEPROM to ensure the job is done. You just have to input the S/N, UUID, and machine type to finish the job. Reflashing both areas is the only way to be ABSOLUTELY SURE the password is gone.

Regardless of the type, the newer laptops (Haswell-present) either use Intel Boot Guard or VERY ROBUST signature checks, which means any attack on the NVRAM or BIOS code if you dump it to attempt to reset it and remove the password or attacks on the ATMEL chip corrupts it and kills the boot process until the "correct" BIOS image is in place which will make the password issue come back :(. These new Lenovos (IdeaPad and ThinkPad) are not built around the idea of security theater like the old ones anyone who knows how to locate the ATMEL chip or properly dump and hack the BIOS can fix. We laughed at these old Lenovo laptops and got the job done; now we just don't bother and bin them with the ThinkPad that smoked since they have just as much value.

HP has some real security in place since the process can only be done on the right machines (read: older and exploited, takes a few years to be added to the list of ones which can be cracked) by dumping the BIOS (often requiring a chip desoldering operation due to physical security; some old laptops can be done without it if it has the exposed side pins on the flash ROM), the unlocking tool (easily found online, NOT NAMING NAMES!), and reflashing the original "unlocked" BIOS to the main EEPROM (which gets shadow copied to the backup on SureStart laptops to ensure it matches up without the password). Main swapping is not possible as you CANNOT MIX THE MAIN AND BACKUP BIOS on those laptops unless you have both ROMs from a clean board (at which point.... swap the board unless it has LD but a "clean BIOS"). Dell is the only vendor left who practices BIOS security theater (please keep practicing it, Dell. It helps the used market and doesn't turn them into parts machines).