Would it be a bad security practice to keep a database of the SHA hashes of maybe the 10 000 most common passwords then alert users who try to use them? Obviously you would do the comparison before applying your actual bcrypt/PBKDF2 function with salt.
This was an unexpected benefit of the Pomodoro technique for me. I ended up walking around during the forced breaks and it definitely reduced the physical stresses imposed by coding days.
I'm intrigued by these sorts of studies - not coming from a statistical background I'm amazed by how few samples they need to draw conclusions. If you told me you only had 341 events in your A/B test I'd be suspicious of the results you were claiming. (Note: I don't do A/B tests professionally so I may not know what I'm talking about...)
They do mention " Random coefficient mixed models accounted for surgeon variability" in the summary so maybe that's sufficient.