On 4 May 2013 19:23, Richard W.M. Jones <rjones@redhat.com> wrote:
Another opinion.

It is possible to study such things, and even give caveats and error
bounds to show uncertainty.



Yes and no. It's possible it a tightly defined setting with specified outcomes. Since a crucial factors here include how likely someone is to either intentionally attempt to steal a password (and how much effort they will go to) or to opportunistically use a casually spotted password and what the consequences of that happening are versus the risk of a potentially wrongly set password it's likely any genuine research is going to be hard to transfer.

--
imalone
http://ibmalone.blogspot.co.uk