I wonder if there are any empirical papers estimating the productivity/welfare loss to society from people deciding to wait the extra ten seconds for their Secure ID / 2FA tokens to refresh.