Here's a novel idea: don't mask password fields by default
If the user can see the password he typed in (and the coffee house guest peeking over the shoulder), the user will not pick "fluffy" as a the password. Ok, so it's not a novel idea, but still something we perhaps should consider (http://www.useit.com/alertbox/passwords.html)?

Or better yet, go with one of the old and proven password management tools. Applications like KeyPass or RoboForm; and services from http://www.myonelogin.com/ are pretty easy to use. Even a the most non-security conscientious employee can remember a single complex password. Oh, and a hint: If you find yourself opening a ton of free one-time or rarely-used account, pick a password that you don't remember or save. If you need to get back in, use the password recovery mechanism or open a new account.

What is the distribution of higher education degrees in the US? For a MSc: 70% legal, 25% medical and 5% others? Anyone know where one can find info on this type of statistics? It would be interesting to compare countries to see what the future will look like. /Biskopen