1. Users are not the enemy
2. Florêncio D. Herley C. and Coskun B. (2007). "Do Strong Web Passwords Accomplish Anything?" Paper presented at the Proceedings of the 2nd USENIX workshop on Hot topics in Security Boston MA. http://www.usenix.org/event/hotsec07/tech/full_papers/florencio/florencio.pdf and also http://research.microsoft.com/pubs/74162/hotsec07.pdf Florêncio D. Herley C. and Coskun B. (2007). "Do Strong Web Passwords Accomplish Anything?" Paper presented at the Proceedings of the 2nd USENIX workshop on Hot topics in Security Boston MA. http://www.usenix.org/event/hotsec07/tech/full_papers/florencio/florencio.pdf and also http://research.microsoft.com/pubs/74162/hotsec07.pdf