Measuring real-world accuracies and biases in modeling password guessability
Can long passwords be secure and usable?