Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of Accounts

It is found that approaches justified by loss-minimization alone, and those that ignore important attack vectors, are amenable to analysis but unrealistic, and an optimal solution for how to group accounts for re-use, and model-based principles for portfolio management is given.