Answers are grounded in this paper and cite their sources.
Securing computer systems has traditionally been the domain of system administrators using technology to protect computer systems from attack. However, in many systems, human users are critical to the security process. There's a growing realization that technology alone can't protect security if users don't properly deploy and utilize it. Ultimately, it's users who create passwords and choose whether to adhere to security procedures.
No takes yet. Share an insight, caveat, or question.
Cranor et al. (2014) studied this question.
Synapse has enriched 10 related papers. Consider them for comparative context: