Key points are not available for this paper at this time.
Theory on passwords has lagged practice, where large providers use back-end smarts to survive with imperfect technology.
Bonneau et al. (Thu,) studied this question.