On Sat, 2013-05-04 at 13:20 -0700, Adam Williamson wrote:
That's it. So far as I can see, that's the sole reference to any actual identifiable study. And again, so far as I can see, the entire 2009 debate spiraled out from that single post, with lots of 'experts' adding their subjective $0.02 on either side (mostly against), but no-one actually adding any kind of useful empirical research.
The other link I've seen cited in favour of the change - http://uxmovement.com/forms/why-password-masking-can-hurt-your-sign-up-form/ - again appears to be solely opinion stated as fact. It's all phrased very categorically, but there is no reference I can find to any kind of actual evidential backing.