Does it make sense to insert a foreign word into a paraphrase to mitigate against brute force? For example: "pussiMeansCatInEskimo" "caballoMeansHorse" "CatIsGatto" "SalopeMeansBitch" "BitchInFrenchIsSalope" "FoShizzleMyNizzle"
In my opinion, if you use phonetic typing of another foreign language's word, it would be secure no matter what dictionary (brute force attack) a hacker may use.
For example (for users who knows Arabic),
Arabic name: khaled Saad (to use this name as password)
in phonetic: 5aledsa3d (some Arabic letters are represented in numbers phonetically in chatting typing)
kh = خ = 5
The weakness with the passwords you provided is that they follow a common form. e.g. foreign[is|means]english. And now this approach is documented (thnaks! ;-)). I prefer groupings of 4 or 5 not just 2 or 3 like in your examples. If you are taking that approach these groupings should be uncommon unrelated words.
Also, my dictionary built from urbandictionary.com would crack FoShizzleMyNizzle the first time around (with my mangling rules).
When assessing security, look at your password, try to generalize it in your head to form a cracking strategy, then identify the parts that are variable and which parts are static. For the parts that are variable, identify the category they fit into. Think about how diverse that category is and how popular your choice is within it (top ten words for example is bad, sequences of characters commonly found together, etc.). This will give you an idea of how many combinations an attacker might have to go through.
I would say if you are going to use a set of dictionary words with no numeric or symbol characters then you weaken the process, especially if the words are related in any way. What you'd then be doing is using words as building blocks for your passwords instead of letters, which isn't going to make the job of guessing them as they are not increasing complexity.
What would be more complex would be using dictionary words, or even a phrase as a building block. If you like Duran Duran take the "Her name is rio and she dances on the sand". A simple way would be to use the first letter, as in hnirasdots . But that's too easy to guess if I know you are using music lyrics. I could alternate using whole words, parts of words, etc like hernisrandsdotsand . That's getting more and more like random text, but limiting it to lower case letters reduced the complexity. H3rn15rand5.0tSand would be very hard to get to from a cracking standpoint even if I know you were using music lyrics as a basis.
It's better to use unrelated words though, preferably of differing lengths, and then widen the character base by throwing punctuation, symbols, and numbers in. Take Carros, Set, and Nixon and transform it into carr0t.s3t*N1x0n for example.
Yes, it does help, but perhaps not as much as you would think.
A password/phrase is a sequence of tokens. In a password, the tokens are characters; in a passphrase the tokens are words.
To increase the resistance of a password/phrase to brute force attacks, you can:
This is called increasing the entropy of the password/phrase.
An important point it that a passphrase (series of words) is also a password (series of characters). An attacker might attack it as a password or as a passphrase, and it's resistance to the attack is different depending on how the attacker treats it.
If the attacker treats it as a password, the main factor is length (since there are few tokens used in words). If they treat it as a passphrase, the main factor is number of tokens (since the length is so short).
So, should you use foreign words? Well, if the attacker treats it as a password, it makes no difference. Length is length. "chicken" and "oiseau" increase the length be the same amount, as does "skdjnqs" and "aaaaaaa" for that matter. If the attacker treats it as a passphrase, then it does make a difference. Using words from French and English almost doubles the number of possible tokens. So it does help, but as I mentioned, not as much as you'd think.
This is because increasing length is a much more powerful technique than increasing number of tokens. A three-word passphrase in english has an entropy of about 40; a three-word passphrase in french and english has an entropy of about 44, but a six-word passphrase in english has an entropy of 81.
In fact, if you run the numbers, it turns out that adding a single extra english word increases the entropy of a passphrase to 54 - ten more than you get by using two languages. Ten bits of extra entropy means a brute force attack will more than a thousand times longer to run.
So adding another word is a much better way to strengthen your passphrase.
(Although an even better way is to add a small random password with numbers and punctuation!)
Lastly I will mention that the phrases in your examples are not random, which is a weakness against generated dictionary attacks, so you should think about that as well. You want something more like CorrectĈevaloBatteryStaple.
A better application would handle brute force attack either by enabling CAPTCHA or delayed response.
From users perspective, you may add your own "salt" to your password. "Salt" could be anything.
It may if the foreign word is "Pneumonoultramicroscopicsilicovolcanoconiosis". It also largely depends on the type of hashing algorithm and the implementation of salts. The general problem is remembering secure passwords without writing them down. Try to make sentences and steal the first letter. For example: