It's something of an open secret that many people don't handle the security of their accounts online in the same way the designers of such systems would want them to. This is why we often see text like "don't re-use passwords", "create a password that's easy to remember but hard to guess", etc. alongside signup forms and forgotten password flows.
What we're looking for is some research into how people work around this nebulous ideal in real life. So for instance, is there any research that discusses:
- How many people write down their passwords on paper or save them in emails?
- How many people share passwords across accounts rather than having unique passwords?
- How many people use password managers instead of trying to do things manually?
I'm looking for research or studies, not guesses.