Neco 2017 Data Processing Question 25

A company enforces a password policy requiring passwords to be at least eight characters long and to contain at least one uppercase letter, one lowercase letter, one digit, and one special character. An employee creates the password "Pass2023!". The company stores passwords as unsalted MD5 hashes. A data breach exposes the list of password hashes. Assume an attacker possesses pre‑computed rainbow tables covering \(10^{7}\) common passwords, none of which match "Pass2023!". The attacker can compute \(10^{9}\) hash evaluations per second and estimates that the total number of possible passwords satisfying the policy is \(2^{48}\). (a) Estimate the expected time, in days, for the attacker to recover the password by brute‑force (assuming the average case of trying half the key space). (b) Briefly discuss two ethical or security implications of the company's password storage practice.