Very well-written summary here. Interesting timing, because we are just about to release a report on this subject based on a lot of consumer and banker interview data. We'll also be uploading a video onto Youtube at the end of this week with what I've called a memorable password cipher, which could be a way for industry to instruct consumers to finally meet the 'impossible three password requirements: make them Hard2cr@ck, unique to each site, and never write them down. Feel free to let me know if you'd like to hear more.