Question

A hacker has programmed their computer to generate, uniformly at random, an eight-character password, with each character being either one of 26 lower-case letters (a-z), one of 26 upper-case letters (A-Z) or one of 10 integers (0-9). The hacker wants to infiltrate a website that has 2 million users. Assume, for simplicity, that each user is required to use a unique password. i. What is the expected number of attempts before the hacker successfully generates a user password? ii. What is the standard deviation of the number of attempts before the hacker successfully generates a user password? iii. Suppose the website used passwords of length four (instead of eight characters). What are the expected value and standard deviation of the number of attempts before the hacker successfully generates a user password? iv. Comment on the security differences between eight- and four-character passwords.

Answer 1