General Framework for Evaluating Password Complexity and Strength
Can long passwords be secure and usable?