Password Construction and Cracking: CYB 333 Tutorial Lab

This document presents a comprehensive solution to the Password Tutorial Lab assignment, focusing on password construction, security, and cracking techniques. The solution addresses several key questions, including the calculation of possible PIN combinations, analysis of password policies, and the construction of passwords with varying character sets. It explores password strength based on character combinations (lowercase, uppercase, numbers, and symbols) and discusses the impact of password length on security. The document highlights the importance of strong password practices, such as using unique passwords for different sites, incorporating passphrases, and utilizing password management software like Keypass. The solution also references relevant research and guidelines from NIST, emphasizing the shift from complex passwords to memorable passphrases for enhanced user experience and security. The document concludes with a discussion on the effectiveness of long passphrases compared to short, complex passwords and provides an overview of Keypass functionalities, including password storage, generation, and organization.

Running head: PASSWORD TUTORIAL LAB 1
Password Tutorial Lab
Name of the student
Name of the Affiliate Institution

PASSWORD TUTORIAL LAB 2
Question 1
A total of 10,000 passwords can be generated. It is computed by raising the total
number of the digits involved, which in this case are ten (namely 0,1,2,3,4,5,6,7,8 and 9), to
the power of the length of the password, which in this case is 4. Thus the actual computation
will be 10^4 which is 10,000, (Aggarwal et al., 2018).
Question 2
The password policy emphasizes more on using a strong password that cannot be
easily guessed or hacked. A combination of lowercase, uppercase, and symbol is considered
safer as it will consume a lot of resources and time, (Ur et al., 2016). Use of different
username and passwords for different sites. Using similar credentials possesses a high risk to
all your sites once one password has been leaked. It is also advisable to unevenly distribute
the character and symbols in the password. Users should also be vigilance and often change
their passwords. It is also recommended to store passwords using secure software such as
RoboForm that will encrypt all your login credential and always clear your browser cache.
Question 3
There are a total of four passwords namely aa, ab, ba, and bb This has been achieved
by raising the number of applicable character to the power of the length of the password to be
formed which is 2^2.
Question 4
A total of 27 passwords can be created from the three lower case characters. The
passwords are

PASSWORD TUTORIAL LAB 3
aaa,aab,aac,aba,abb,abc,aca,acb,acc,baa,bab,bac,bba,bbb,bbc,bca,bcb,bcccaa,cab,cac,cba,cbb,
cbc,cca,ccb and ccc.
Question 5
The passwords that can be created:
 With letters (both upper and lower case) are 208,827,064,576
 With letters (both upper and lower case) and numbers are 2,821,109,907,456
 With letters (both upper and lower case), numbers and special
characters/symbols are 513,798,374,428,641
Question 6
The guidelines provided by the NIST seems worthwhile to be ushered and adhere to;
since in most cases where organizations have policies that strictly demand their employees to
change password after every 3 months don’t really guarantee much safety as most users often
tend to change just a character or two, or probably interchange the arrangement of the
characters. According to Grassi (2017), further illustrated that the previous guidelines are
producing passwords that are hard for users to remember but easy for the "bad” guys such as
hackers. The guidelines further encourage the adaptation of password that will comprise the
passphrase that contain several words that can be easily adapted by our cognitive and hard to
be guessed and cracked. This will, in turn, surpass the traditional guidelines, thus the
password will be easier for the users and harder for the hackers.

PASSWORD TUTORIAL LAB 4
Question 7
Just discovered that a ten character password like Miami@2018 has a strength of less
than 65%, to be specific 62% yet it contains all the possible combinations of uppercase,
lowercase, numbers and a symbol whereas a passphrase comprising of just words like my
password was Miami has a strength of 100%. Long passphrases are stronger than short
complex passwords, (Seitz et al., 2016).
Question 9
Keypass stores usernames, passwords and necessary information in an encrypted file
that can only be accessed by authorized persons. The program also allows the user to back up
the file to other external devices in case of a system break down. The file can also be
accessed by use of the combination of your master password, windows password and the key
file. In addition, it has a password generator and strength meter which can assist users in
creating strong passwords that are more secure.
In addition, passwords can also be managed into manageable groups such as general,
windows, network, internet, email and home banking, thus making it a very user-friendly and
convenient program to interact with. The passwords can also be exported into various format
such as .html, .txt, .csv and .xhtm. Also one can import passwords that were initially saved. It
is also easily compatible with browsers and provides an auto-type platform where it will
autotype the password for the authenticated user.

PASSWORD TUTORIAL LAB 5
References
Aggarwal, S., Houshmand, S., & Weir, M. (2018). New Technologies in Password Cracking
Techniques. In Cyber Security: Power and Technology (pp. 179-198). Springer, Cham.
Grassi (2017, August 14). Forget Tough Passwords: New Guidelines Make It Simple Retrieve
from https://www.npr.org/sections/alltechconsidered/2017/08/14/543434808/forget-
tough-passwords-new-guidelines-make-it-simple
Seitz, T., von Zezschwitz, E., Meitner, S., & Hussmann, H. (2016). Influencing Self-Selected
Passwords Through Suggestions and the Decoy Effect. In Proceedings of the 1st
European Workshop on Usable Security (pp. 1-2).
Ur, B., Bees, J., Segreti, S. M., Bauer, L., Christin, N., & Cranor, L. F. (2016, May). Do
Users' Perceptions of Password Security Match Reality?. In Proceedings of the 2016
CHI Conference on Human Factors in Computing Systems (pp. 3748-3760). ACM.