The original post you're replying to was deleted, but, this comment interested me enough that I went and looked for the paper. It isn't up yet, but here's a wri

The original post you're replying to was deleted, but, this comment interested me enough that I went and looked for the paper. It isn't up yet, but here's a writeup of it from the Boston Globe: http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/please_do_not_change_your_password/?page=full http://www.boston.com/bostonglobe/ideas/articles/2010/04/11/.... The paper (Please Continue to Hold: An empirical study on user tolerance of security delays) is by Cormac Herley and a few others. All the other papers on Herley's page (http://research.microsoft.com/en-us/people/cormac/ http://research.microsoft.com/en-us/people/cormac/) are up, so, I'm assuming that this one will be too, at some point in the future.