Bruce Schneier has written a long draft on the psychology of security.