This study http://www.oniros.fr/A1350.pdf seems to indicate that sleep duration has no effect. Their interpretation is that a process is triggerd when you enter sleep but once triggered it is independent of wheter you sleep or not.
So instead of providing negligible traffic compared to google, it now provides 22% less traffic
The 22% drop is not for traffic but for impressions.
Cost per Acquisition (CPA) down 3%
It seems however that it is positive for publishers since CPA is going down.
I don't know much about SEM but to me it seems that their advertising network is qualitatively better than before. At least on this matter and if figures are correct.
not having someone look at your password over your shoulder is a requirement
What I say is that sometimes this is not a requirement even if the website offers a login feature.
I guess that for my online mail client I would prefer to have a masked password field.
Now for my account at an online rss reader I actually don't care that much because there is nothing to protect (at least in my opinion) and no value for someone to steal and remember my password. Maybe however I still want to be protected against someone on the web who happens to have the same name as I do and wants to steal my account... However the probability for this guy to be over my shoulder is quite low.
Maybe this is all a question of personal interest. Some users will prefer usability over security while others will prefer the opposite no matter the application. If this is the case then I would vote for having the option to toggle between one and the other...