Science of Security: Combining Theory and Measurement to Reflect the Observable
The security of modern password expiration: an algorithmic framework and empirical analysis