I don't see a clear answer to the paper's question in the discussion. Either the users, the technology or both should be blamed for bad passwords. How do you tie the results to answer the question? How do you motivate the answer for/against the users and technology respectively?