2. Copyright Pearson Prentice-Hall 2010 2

3. 3 Password Length in Characters Low Complexity: Alphabetic, No Case (N=26) Alphabetic, Case-Sensitive (N=52) Alphanumeric: Letters and Digits (N=62) High Complexity: All Keyboard Characters (N=80) 126526280 26762,7043,8446,400 4456,9767,311,61614,776,33640,960,000 6308,915,77619,770,609,66 4 56,800,235,58 4 2.62144E+11 82.08827E+115.34597E+132.1834E+141.67772E+15 101.41167E+141.44555E+178.39299E+171.07374E+19 Note: On average, an attacker will have to try half of all combinations.

5. Copyright Pearson Prentice-Hall 2010 5

6. 6

8. Use Password Manager 1Password Roboform Password Based Key Derivation Function Version 2 (PBKDFV2) Systems using PBKDFV2 Copyright Pearson Prentice-Hall 2010 8

9. Copyright Pearson Prentice-Hall 2009 9

10. Copyright Pearson Prentice-Hall 2010 10

15. ItemMean Number of Sites105.7 Number of Unique IDs6.6 Number of Unique passwords4.7 Number of Unique log-in credentials11.8 ID re-use ratio19.1 Password re-use ratio29.2 Log-in credentials re-use10.5 % of used unique log-in credentials45.6%

17. ItemMean Inclusiveness0.94Use the same log-in credentials Largest component0.54 2 nd largest component0.180.72 (cumulative) 3 rd largest component0.090.81 (cumulative) Vulnerability Index0.38 3 most frequently used log-in combinations use in 81% of sites vs. 11.8 unique log-in credentials VI = expected proportion of sites subject to potential breaches if a breach at one site occurs Larger values of VI indicate higher levels of vulnerability