Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is?

Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.

(Also assume that I didn't tell anyone that I am doing it this way, although I just told the world... Doh!)

I ask because I would like more security in a way that I can still remember, and this would be an easy change to make and recall. Thank you.

share|improve this question
113  
Not anymore since your security by obscurity is gone. I've included both formats and added them to my dictionaries. Thanks! – Mark Buffalo Feb 1 at 19:58
    
If the cracking alorgrithm is bad then yes. – Suici Doga Feb 6 at 14:31

11 Answers 11

up vote 95 down vote accepted

Let's try skipping theory and going straight to practice.

Will typing the same word twice (or N times) substantially help?

  • John the Ripper Jumbo has a variety of "simple rules" about this

    • d duplicate: "Fred" -> "FredFred"

    • f reflect: "Fred" -> "FredderF"

  • oclHashcat rules based attack has simple rules just for this, too

    • d Duplicate entire word d p@ssW0rd p@ssW0rdp@ssW0rd

    • pN Append duplicated word N times p2 p@ssW0rd p@ssW0rdp@ssW0rdp@ssW0rd

    • Reflect f Duplicate word reversed f p@ssW0rd p@ssW0rddr0Wss@p

  • Therefore, no, this bit of cleverness is so common it's included explicitly in both common rulesets already for use by itself, or in combination with other rules.

OR type every character twice

  • John the Ripper Jumbo has an example specifically about this in the documentation

    • XNMI extract substring NM from memory and insert into current word at I is the core rule

    • "<4X011X113X215" (duplicate every character in a short word) is the example in the documentation to cover exactly your case for short passwords

.

  • oclHashcat rules based attack has simple rules just for these kinds of attacks

    • q Duplicate every character q p@ssW0rd pp@@ssssWW00rrdd

    • zN Duplicates first character N times z2 p@ssW0rd ppp@ssW0rd

    • ZN Duplicates last character N times Z2 p@ssW0rd p@ssW0rddd

    • XNMI Insert substring of length M starting from position N of word saved to memory at position I lMX428 p@ssW0rd p@ssw0rdw0

  • Therefore, no, again, this is such a common bit of cleverness that it's called out explicitly in both major open source cracking products.

Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.

The other rules in those products very likely cover everything you're doing already, and it's also likely that whatever combination you have is already included in a ruleset applied to a reasonable cracking wordlist.

  • oclHashcat alone comes with twenty five different files full of .rules, including d3ad0ne.rule with more than 35,000 rules, dive.rule with over 120,000 rules, and so on.

  • a large number of wordlists are available, some of which may include your exact password - the Openwall wordlist alone has a single 500MB file of more than 40 million words including mangled ones

  • and I'm personally aware of both small, very good wordlists (phpbb, et all) and huge, comprehensive wordlists with literally billions of entries, taking up many gigabytes of space total.

As with everyone else, you need to use try randomness or something like an entire sentence worth of personal anecdote that does NOT use words in a top 5000 list of common English words, and does use long, uncommon words (to force combinatorial attacks using much larger dictionaries).

Specifically look, for example, for words selected at (good) random included in Ubuntu's insane english ispell dictionary list that are not included in the standard english ispell dictionary, for example.

share|improve this answer
37  
@nocomprende To some people, this is enjoyable. To most people, this is highly profitable. – Technik Empire Feb 2 at 23:01

Security.StackExchange is full of questions proposing "home-brew" password strategies. The short answer is always the same: doing something to differentiate your password from the standard dictionary attacks is good - as long as

  1. Very few other people on the planet are also using your strategy. If your "home-brew" strategy turns out to be common - like replacing 'a' with '@' - then it'll get included in the standard dictionary attacks and you're back to square one.

  2. You're not being personally targeted. If you are enough of a high-value target that attackers are specifically trying to break your account, then any pattern you use is a liability because once they know your pattern (say from your leaked passwords from previous leaks) then they'll build dictionaries based on your pattern.

Another trend with this type of question here on infosec, is that someone inevitably references XKCD, so here goes. Remember that computers are good at searching databases and generating lists based on patterns. By using a simple strategy like "doubling every letter", or "the initials of the chorus of my favourite song", etc, you are using a strategy that's easy for computers to guess. The best practice for coming up with a simple password strategy is always: don't. Use a password manager like LastPass to generate and remember a 32-char random password for you. If you insist on having something that you can memorize, then the next best practice is diceware.

If you want to defy all best-practices and invent your own scheme, then I would recommend something emotion-based rather than pattern-based, or something that can be mined out of your personal information. For example a password based on "websites I like", or "TV shows I watch" would be easy to guess for anybody with access to your internet activity, but "things that remind me of ______" where you pick a very different ______ for each password could be hard to guess. (If I thought about this scheme a bit longer, I could probably argue that even this is easy enough to guess, but the point is that it's still better than something purely pattern-based.)

enter image description here

share|improve this answer
15  
I agree that password managers lack user friendliness. No arguments there, but they do work, and are more secure than making a password so complex that you can't remember it. Ultimately we need to do away with passwords entirely and move entirely to public key / biometric authentication, but the world is not ready for that. In the meantime, things like password managers, and changing public perception from passwords to passphrases is a good start. – Mike Ounsworth Feb 1 at 18:35
7  
Speaking of "the initials of the chorus of my favourite song": there was a story where someone opened a random book on their shelf, picked a random page, and used a random sentence on that page as a Bitcoin brainwallet password, and it got guessed (and they lost all their bitcoins). – immibis Feb 1 at 21:16
8  
@MikeOunsworth But you can't change the bits of your finger if someone sniffs the data you send, not to mention afaik we don't really calculate a value from the finger image but use the image to check a few points in stored in the database to make sure they match (NOT to mention people frequently have problems with fingerprint unlocking after some exercise, or in some other not extremely rare cases). I guess it kinda falls under "not mature enough", but I find it unlikely you can solve their unchangeability. I could imagine fingerprint being used to unlock my keepass db though! – Maurycy Feb 1 at 21:27
3  
@Maurycy continuing with the XKCD theme... imgs.xkcd.com/comics/security.png – duzzy Feb 2 at 19:41
4  
@MikeOunsworth, you may also want to read "Your Unhashable Fingerprints Secure Nothing". – Wildcard Feb 3 at 7:42

In general, no, doubling the password does not substantially increase (or decrease) your security. What it doubles is your typing effort. Doubling your password may decrease your security if it incites you to choose a shorter/easier base password so that your typing effort is not too cumbersome.

In broad terms, password security comes from its randomness, i.e. how much the attacker does not know. In the case of "doubling", this is a one-bit information (i.e. whether you applied it, or not), so, mathematically speaking, it is one extra bit of entropy. That's not much. Typing eight extra characters to gain a single bit of entropy is meagre; this is not a good bargain.

All witty tricks share the same fundamental problem: they are witty. They rely on the attacker being stupid, incompetent or archaic. This does not hold in practice, except against attackers who really are stupid, incompetent and archaic -- the gods know that they are many of them, but they are not a big problem, because they would not know what to do with your password. The attackers that you should worry about are the smart ones, who can enact substantial damage to your digital assets in a short time; these smart attackers won't be much deterred by your password doubling trick.

Consider reading this famous question to get some information about what makes a password "strong", in particular the entropy maths in that answer.

share|improve this answer
8  
It's more than one bit, unless at least 50% of people double their password. – immibis Feb 1 at 21:14
1  
@immibis: ah, that's the catch. Doing something that "most people won't do" is not the same as doing something that "the attacker won't try first because most people don't do it". Claiming that you gain more than one bit through password doubling is making a bet on the attacker's indifference or incompetence. Unfortunately, this does not hold against the most dangerous attackers, who are after you, personally. – Tom Leek Feb 2 at 15:30
5  
Also, the field is very dynamic. E.g. if most attackers try passwords in alphabetical order, then users begin to start their passwords with 'zzz'. Pretty soon, attackers adapt and start doing enumeration in reverse order. Or in random order, which guarantees attackers against worst cases. Trying to play tricks depending on average attacker behaviour tends to backfire. The notion of entropy is what remains when the attacker knows perfectly how you generate passwords -- thus, entropy is the only robust foundation for password security. – Tom Leek Feb 2 at 15:32
1  
I think that hackers are working too hard. They should just try an ordinary job, it is much easier! – no comprende Feb 2 at 17:32
2  
I like your point about eight letters to gain 1 bit of security. Compare to some random English 8 letter word, which would gain you maybe 10 or 12 bits of entropy. – corsiKa Feb 2 at 19:16

My password cracker already tries letter doubling, word doubling, word reversing and doubling, word-case-flipping and doubling...

...and many more.

Yep. Doubling adds some to the difficulty: about four bits worth, tops. It'd take me sixteen times longer to crack, than a raw dictionary attack with letter replacements.

But I'd eventually get BAdpA55!!22AqbA8.

share|improve this answer
    
So, what strategy would defeat your password cracker? – no comprende Feb 2 at 2:13
7  
The strategy that everyone is recommending: a long truly random string. And use a keyfile or other kind of auth at the same time too, if at all possible. I like password managers myself (I use LastPass but haven't really done any kind of a review of what's out there, I just used the first product that worked. Various of my friends swear by various other products). But the thing that worries me about them is that you then have a single point of failure: one password protects all the others. – Dewi Morgan Feb 2 at 3:28
7  
This is why I advocate that the "real" password should be something that nobody knows, including you. It IS you. Your dog would know an imposter in about 500 millisec. That is what we need. And, if the dog did get fooled, it would get plenty mad when it found out. So we need computers to be intelligent, with full sensory capability, and as strong as a gorilla. Wait a minute... – no comprende Feb 2 at 17:37
    
@no comprende: And then you come home drunk and your dog doesn't recognize you (because you smell funny, and speak funny, and walk funny, and act funny; as far as the dog is concerned, you ARE NOT "you." BTW this scenario actually happens quite often IRL). And it gets plenty mad. What exactly did you train the dog to do to intruders? Oops. (In other words, your scenario is built on the invalid premise "false negatives never happen.") – Piskvor Feb 4 at 13:35

Humans are surprisingly predictable creatures. The way we think is not nearly as unique as we would like to believe. Chances are, any clever thing you can think of to make your password more secure, has already been thought of by lots of other people, and hackers are well aware of all of these clever tricks.

The only way to make a password properly secure, is to make it long and random. Remove the human fallibility from the equation. If a password is so complex you can't possibly memorize it, then it may be secure enough.

Password managers are extremely helpful. They allow you to make every password you use unique, and every password completely random.

You obviously need to ensure that your password manager database is secure though, and cannot be accessed remotely.

share|improve this answer
    
So, the answer is to protect the passwords and the software with another password and more software? I have two bridges in New York to sell you... – no comprende Feb 2 at 17:40
2  
The services requiring secure passwords are remotely accessible. My password manager program is not. – user1751825 Feb 2 at 23:39

There are a lot of factors but it ultimately breaks down to what type of password cracking are you trying to protect against. Against a brute force hack increasing the length of the password will make it harder to crack. Assuming their hashing isn't horrible a decent 8 or 9 character password should already be very hard to impossible to brute force crack. That means doubling it by typing each character twice or typing the same password twice really doesn't do much.

Once your password is long enough to be safe against a brute force attack then you have to start worrying about dictionary attacks, combination attacks and other things like that. Either of the things you suggest would be easy to include in a rules based attack and any value in additional security from that is depending on it not being commonly done and not being included in their set of rules.

share|improve this answer
    
Here's a great article that backs up your point: link. – Mike Ounsworth Feb 1 at 22:10

Link to zxcvbn password entropy demo.

According to zxcvbn, your initial password's stats:

Normal: PwdThing

 Guesses:
    100 / hour:     5 months    (throttled online attack)
    10  / second:   58 minutes  (unthrottled online attack)
    10k / second:   35 seconds  (offline attack, slow hash, many cores)
    10B / second:   less than a second  (offline attack, fast hash, many cores)

Doubled: PwdThingPwdThing

guess times:
100 / hour:     9 months    (throttled online attack)
10  / second:   2 hours (unthrottled online attack)
10k / second:   1 minute    (offline attack, slow hash, many cores)
10B / second:   less than a second  (offline attack, fast hash, many cores

Letter Doubled: PPwwddTThhiinngg

guess times:
100 / hour:     centuries   (throttled online attack)
10  / second:   centuries   (unthrottled online attack)
10k / second:   centuries   (offline attack, slow hash, many cores)
10B / second:   12 days (offline attack, fast hash, many cores)

zxcvbn might not be perfect, but I feel like it gives you a pretty good ballpark estimate of your password strength. Play around with it to get a nice memorable password with a high rating.

I prefer sentences to use as passwords. They're long, and inherently difficult to guess and easy to remember.

EX: "My 2nd favorite fruit, on Mondays, is mango!" (spaces included where allowed)

If you're worried about the NSA brute forcing your password... I'd go with the generated passwords everyone else is talking about.

share|improve this answer
4  
Although this is a great comparison of the different options, it does not take into account the pattern being known. If the pattern is known, there is no difference between "PwdThing" and "PPwwddTThhiinngg". The required element is that the password pattern is kept secret along with the password content. – schroeder Feb 2 at 22:22
2  
Apparently, the best solution is to destroy the attackers. – no comprende Feb 2 at 22:33

adding length to a password does substantially increase the security of a password so I think typing your password twice or doubling every character is better than not doing it and using a shorter password of 8 or 9 characters. Refer to this link to read more about how increasing password length significantly improves its security: https://www.grc.com/haystack.htm

share|improve this answer
3  
I don't buy their basic premise. Their premise is "Once an exhaustive password search begins, the most important factor is password length!". This is not realistic: who does exhaustive searches!? Real-world password crackers do dictionary lists, and if that fails, they do permutations of dictionary lists, and if that fails, they construct phishing (or spear-phishing) emails. As a counter-example, that site would argue that "password" is significantly stronger than "passw" because of its length, despite it being the first thing that any dictionary attack will try. – Mike Ounsworth Feb 1 at 20:41

Two things make a password more secure: Length and randomness. So, the answer to your question is definitively Yes, you are increasing security of your password.

But in general, your initial password is not super secure because it uses words that can be found in a dictionary. And, the doubling is just a repetitive pattern that an cracking algorithm can easily do to too. So, not only double your password, make sure what you double aren't actual words.

share|improve this answer
    
Right, I did say in the question: "Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters." I guess the even password length is the big giveaway that I typed it 2x, right? I mean, lots of people probably do that. 50% of all passwords are even length... – no comprende Feb 1 at 23:56
    
Yea, sorry, didn't read carefully enough. But still, the longer the better. I prefer passwords > 12 char (including the stuff you are mentioning). – user98946 Feb 2 at 3:03
    
"50% of all passwords are even length..." May I ask what you think that percentage SHOULD be? – J Kimball Feb 2 at 13:38
1  
@JKimball "40% of all employee absences are on Mondays and Fridays! It's a scandal!" (from a Dilbert comic) – no comprende Feb 2 at 17:38

The length of the password is always a key factor in password security but try to improve the content also, doubling the password may help against the pratice with HYDRA/Dictionary attacks

share|improve this answer

@SethWhite - believe you have given the most accurate answer.

Many users don't understand the avenues and methods used to break a password. Also there are additional security measures such as port blocking for unknown http/ftp callers. Someone better versed should explain.

Seth shows that there are at lease four different avenues to breaking a password the hard way. Easiest way is to Phish, look under keyboard, sticky notes on monitor for slip of paper etc.

Passwords are only part of what is protecting your data from attack. Your password(key phrase) is used to generate a random long binary(machine code) sequence that can only be decoded with your password and the sofeware algorythm that encoded it. So anyone just trying to guess this binary sequence (HASH) on the base data (without using the decoder software that a login page uses) will have to try randomly starting with the first byte until they randomly guess all bytes. This is what Seth shows as Brute force and you need lots of time and many cores for 64,128,256,512 byte HASH lengths. Time to hack goes up exponentially with length. The HASH length is based on the password size so longer password longer HASH longer brute force time.

I believe Wikileaks took many months to break the code but most HASH can be broken. I would think the data-service center hacks were dictionary attacks where the hacker used the login decoding software to guess the passwords. Dictionary attacks therefore usually have some kind of access to the system your data is on not just the data.

Fore instance as I understand the throttled online attack picks away over an http connection, possibly supported by a hacked cookie(small usually helpful program installed by web-servers) to "Dictionary attack your system".

Conclusion: long random passwords ("PPwwddTThhiinngg" counts) help a great deal to stop both kinds of attacks. Password length and complexity should reflect the danger to dictionary attacks and sensitivity to the information stored.

P.S. My family hates me because our home-wireless-network is protected by a 128 byte random key-phrase.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.