I just finished reading a book on this very topic, and recommend it highly.

_Perfect Passwords_ by Mark Burnett, available at:

http://www.amazon.com/Perfect-Passwords-Selection-Protection...

It's full of great analysis, as well as a fun table of the 500 worst passwords of all time. :)

(Note: I am not connected with the publisher or author in any way.)