Главная мысль с сылки http://www.technologyreview.com/printer_friendly_article.aspx?id=25826
The new scheme from Microsoft Research does away with complexity requirements entirely while protecting against both dictionary attacks and statistical guessing. The service simply counts how many times any user on the service chooses a given password. When more than a small number of users pick a password, the password is banned and no one else is allowed to choose it. The scheme can only be used by organizations with millions of users--websites like Microsoft's Hotmail, for instance.
