Real-World Passwords - Bruce Schneier analyzes user data from a phishing attack and reports on password distributions, lengths, frequencies, etc. Very interesting, "password1" is the new "password".