An online security firm has surveyed customers from a large bank to investigate the quality of their passwords. The survey classifies passwords into three categories.

Bad: 20% use this category password

Okay: 35% use this category password

Good: 45% use this category password

The security firm has enlisted the help of white hat hackers to crack a sample of passwords, from all categories. The white hat hackers have reported that within a week of automated hacking, bad passwords have a 99.5% chance of being cracked, okay passwords have an 8% chance of being cracked, and good passwords have a 0.15% chance of being cracked.

The Questions

(a) What proportion of the bank’s customers are at risk of having their password cracked within a week of automated hacking?

(b) If a customer’s account has been hacked, what is the probability they didn’t choose a bad password?

(c) One of the security firm’s recommendations is for the bank to install a widget on their website to try and prevent some bad passwords from being accepted. How successful will this widget need to be in order to reduce the overall risk of a customer’s password being cracked to 10%? You may assume that the widget is equally likely to detect any bad password, and if successful the customer will always choose either an okay or good password, but with the same relative likelihood as before.

What have I done?

How have I defined the events?

Let $B$ be the event "a customer has used a bad password"

Let $O$ be the event "a customer has used an okay password"

Let $G$ be the event "a customer has used a good password"

Let $H$ be the event "the customer's password has been hacked"

Stating the known probabilities:

Pr$(B) = 0.20$ $\space$ Pr$(H | B) = 0.995$

Pr$(O) = 0.35$ $\space$ Pr$(H | O) = 0.08$

Pr$(G) = 0.45$ $\space$ Pr$(H | G) = 0.0015$

For (a) I used law of total probability to obtain Pr(H) = 22.77% I am confident in this result.

For (b) I used complement rule of conditional probability and Baye's theorem to get Pr$(\overline{B} | H) = $ 12.6% I am also confident in this result.

For (c) this is where I need help guys I don't even know where to start.

$$\text{Thank you in advance!}$$


If the widget's success rate is $p$, then the proportion of bad passwords will be $(1-p)\cdot 0.2$ (so, if the widget is $0\%$ successful, the proportion of bad passwords is still $0.2$ or $20\%$.

The $p\cdot 0.2$ passwords get distributed among good or okay at a ratio of $35:45$, which is $7:9$, meaning that the new proportion of okay passwords is $0.35 + \frac{7}{16}\cdot (p\cdot 0.2)$, and the new proportion of good passwords is $0.45 + \frac{9}{16}\cdot (p\cdot 0.2)$.

Now, use the same formula as in (a) to get the overall risk of having the account cracked as a function of $p$, then simply find the value of $p$ for which the total risk is lower than $0.1$.

  • $\begingroup$ Thanks @5XUM ...but just to clarify, what do you think 'as a function of p' would look like? I'll show you the formula I used for (a): Pr(H) = Pr(H | B) $\cdot$ Pr(B) + Pr(H | O) $\cdot$ Pr(O) + Pr(H | G) $\cdot $ Pr(G) = 0.2277 I'm not quite sure how to make the connection between that equation, and turning it into a function of p for which the total risk is lower than 0.1 $\endgroup$ – Rubicon Apr 11 '16 at 10:12
  • 1
    $\begingroup$ @Geekbabe Your formula is good, but now you must replace Pr(B) with $(1-p)\cdot 0.2$, not $0.2$ as you did in (a). Do the same with the other progabilities, and you will get $P(H)$ to be equal to some expression that involves $p$. $\endgroup$ – 5xum Apr 11 '16 at 10:24
  • $\begingroup$ So does that mean replace Pr(O) with 0.35 + $\frac{7}{16} \cdot (p \cdot 0.2)$ and Pr(G) with 0.45 + $\frac{9}{16} (p \cdot 0.2)$ ? $\endgroup$ – Rubicon Apr 11 '16 at 10:39
  • 1
    $\begingroup$ @Geekbabe Exactly. $\endgroup$ – 5xum Apr 11 '16 at 10:46
  • 1
    $\begingroup$ @Geekbabe I advise you to slow down and double-think every step of the way. So, answer these questions: (1) what is the expression you are getting? (2) What does this expression mean? (for example, what does it mean if $p=0.2$? (3) Given the answer to (2), what should this expresion be equal to? $\endgroup$ – 5xum Apr 11 '16 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.