The Rational Rejection of Security Advice by Users [pdf]
microsoft.com