Homework 3

This homework is focused on passwords, mobile security, and web privacy.



Q1 (3 points)
The following is the output of the crypt() password hashing function under a departmental Linux machine (e.g., attu):


The password is one of the following words. Which word is it?

Q2 (3 points)
What is the entropy (rounded to the nearest whole number) of Passfaces with a random system-generated password that is five faces long (where each grid has 9 faces)? Recall that entropy is the bit-strength of a password, e.g., a random system-generated 8-character password composed of upper and lower case letters has approximately 46 bits of entropy.

Q3 (3 points)
Explain the purpose of a salt in password hashing.

Q4 (3 points)
Investigate how to turn on two-factor authentication for one of your favorite sites (Gmail, Facebook, ...). Then answer this question: would you / do you like this feature or not, and why? (Since some of you may not like this feature, we are not actually asking you to start using it -- just to investigate how you might start to use it.)

Q5 (4 points)
From a security perspective, how do mobile platforms like Android and iOS differ from traditional desktop operating systems?

Q6 (5 points)
Mobile platforms like Android and iOS ask users to make decisions about which permissions to grant applications (e.g., location, camera, network, etc.). Compare and contrast the time-of-use prompt (iOS) and install-time manifest (Android) models for permission granting. (Note: Android just changed its model to use iOS-style prompts! Please answer this question according to the "traditional" Android design, but feel free to offer your opinion on this switch.)

Q7 (3 points)
Explain (perhaps with a diagram) how an advertiser can use a browser cookie to track a user across sites.

Q8 (6 points)
Experiment with an anti-tracking browser add-on, such as Ghostery, Lightbeam, or Privacy Badger. Pick three websites (e.g., www.cnn.com, www.facebook.com, and www.weather.com -- though you may pick any sites), visit them with the add-on installed, and report on what you find. How many trackers are on each site? Can you think of ways to improve the add-on you tried? Does anything surprise you?