Of passwords and people: measuring the effect of password-composition policies
The security of modern password expiration: an algorithmic framework and empirical analysis