6. 1. password (Unchanged)13. 1234567 (Down 6) 2. 123456 (Unchanged)14. sunshine (Up 1) 3. 12345678 (Unchanged)15. master (Down 1) 4. abc123 (Up 1)16. 123123 (Up 4) 5. qwerty (Down 1)17. welcome (New) 6. monkey (Unchanged)18. shadow (Up 1) 7. letmein (Up 1)19. ashley (Down 3) 8. dragon (Up 2)20. football (Up 5) 9. 111111 (Up 3)21. jesus (New) 10. baseball (Up 1)22. michael (Up 2) 11. iloveyou (Up 2)23. ninja (New) 12. trustno1 (Down 3)24. mustang (New) 25. password1 (New) compiled from files containing millions of stolen passwords posted online by hackers.

8. *eight hundred thirty nine quadrillion, two hundred ninety nine trillion, three hundred sixty five billion, eight hundred sixty eight million, three hundred forty thousand, two hundred twenty four

9. Copyright Pearson Prentice-Hall 2010 9

15. 15

22. ItemMean Number of Sites105.7 Number of Unique IDs6.6 Number of Unique passwords4.7 Number of Unique log-in credentials11.8 ID re-use ratio19.1 Password re-use ratio29.2 Log-in credentials re-use10.5 % of used unique log-in credentials45.6%

25. ItemMean Inclusiveness0.94Use the same log-in credentials Largest component0.54 2 nd largest component0.180.72 (cumulative) 3 rd largest component0.090.81 (cumulative) Vulnerability Index0.38 3 most frequently used log-in combinations use in 81% of sites vs. 11.8 unique log-in credentials VI = expected proportion of sites subject to potential breaches if a breach at one site occurs Larger values of VI indicate higher levels of vulnerability

30. Basic8Survey Password must have a minimum of 8 characters 18 bits of entropy To link your survey response Basic8 Password must have a minimum of 8 characters To update from e-mail breach Basic16 Password must have a minimum of 16 characters 30 bits of entropy To update from e-mail breach Dictionary8 Password must have a minimum of 8 characters Password can NOT be a dictionary word 24 bits of entropy To update from e-mail breach Comprehensive8 Password must have a minimum of 8 characters Password can NOT be a dictionary word Must have 1 upper, 1 lower, 1 numerical, 1 special character Must not contain a dictionary word 30 bits of entropy To Update from e-mail breach

32. Fixes: Binding Mechanisms Allow a new site/app to remind in the future to update my credentials Secure Defaults I say use a password manger User Friendliness Make credentials easier for humans Face recognition vs character string memorization Incentives Discount for using strong passwords Costs for not – Why are CC companies responsible for your lack of a strong password?

33. Use Password Manager 1Password Roboform Password Based Key Derivation Function Version 2 (PBKDFV2) Systems using PBKDFV2 Copyright Pearson Prentice-Hall 2010 33

34. Copyright Pearson Prentice-Hall 2009 34

35. Copyright Pearson Prentice-Hall 2010 35

39. 39

46. "There [were] a lot of variations of the word pass and root and also hax was used many times, but if I omit one common 4- letter word, the most frequently used word in this dictionary is hack," Hýža wrote. "It is worth mentioning that many PHP shells I analysed had only default passwords like r57, c99, password or yourpass." http://arstechnica.com/security/2014/06/its-official-malicious-hackers-have-crappy-password-hygiene-too/