2024/2025: Segurança da Informação (Information Security) - 1º MCI

26.Nov.2024

Practical work 8

Password issues

1. Google a bit for information on the importance of "hardening" your password and find some on-line tools that evaluate the strength of passwords. From your findings:
   • Open for use some on-line tools
     • (Suggestion: How Secure Is My Password?)
     • (Suggestion: The Password Meter)
   • Compare the features and usefulness of the tools
   • Compare the strength of half a dozen passwords as measured by those tools, and
     • compare your findings with the ones in Why you STILL can’t trust password strength meters (2016). *
2. Now, read the following (short) articles:
   • Say g**dby# to annoying password rules (Tatum Hunter, "technology writer" for The Washington Post, summary starting from "National Institute of Standards and Technology (NIST) proposed new guidelines for protecting people’s digital identities from fraud", 2024);
   • Why you don’t need long, complex passwords ("security adviser" Roger Grimes, 2014).
3. Find out what "password managers" are used for. From your findings:
   • Try out their usefulness with freely available software
     • (Multi-platform suggestion: KeePassX - Cross Platform Password Manager)
     • (MsWindows suggestion: KeePass Password Safe)
   • Make sure you understand the importance of the "master key"!
4. Take some conclusions on the importance of the current use of passwords and their choice and protection.

* There was a previous article (2015) from the same author, that now seems to be "out of comission" on the web. Try yourself:never-trust-password-meters.html.

.

(To be made after class and by oneself!)

(To be made after class and by oneself!)

(To be made after class and by oneself!)

Assessment 8

Assessment of Practical classes - Password issues

Using the information you got on-line during the practical class on Password issues, answer the following questions and send them in a short report, for evaluation.

1. From all the on-line tools for measuring the strength of passwords you tried, what do you consider to be the most useful one?
2. Do you believe you are using passwords that can be considered robust?
   • And do you believe you are adequately managing the many passwords you certainly need in order to access your "important" websites?