Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ?

I usually need random strings for salts and for passwords, and I wonder if that method is sufficient or not, or do I need a strong algorithm to generate the passwords for me.

Assuming that I will include numbers and maybe special characters and small/capital letters

share|improve this question
6  
This is not an answer per-se so I'll post as a comment, but I think you are doing it wrong. The difficulty of guessing a password increases much more rapidly with length than with randomness. The password "Passwords that are phrases are easy to remember, and very secure -- people should use them more" is infinitely harder to guess than "s1DRyYbCDgjXE" and much much easier to memorize. So don't focus on having random passwords, focus on having long passwords. The same goes with salts. –  Andreas Bonini Jan 30 '13 at 15:51
1  
@AndreasBonini Technically, the longer password isn't infinitely harder. But based on the results from howsecureismypassword.net, it's about 4.7e160 times stronger, which I think is pretty close to infinity ;) –  Matthew Crumley Jan 30 '13 at 19:05
1  
@AndreasBonini I think this XKCD comic explains it nicely. –  Petr Pudlák Jan 30 '13 at 20:24
    
@AndreasBonini: on the contrary: randomness is everything. Having a long password is just an easy way to get more randomness in the situation where the password "makes sense" for a human, with very little additional randomness per character. You have to focus on long passwords when the password generation process is not very random (e.g. it was performed by a human in his mind). –  Thomas Pornin Jan 31 '13 at 12:07
    
@Thomas: well, taking what I said very literally you are right, but you know what I meant ;) Let's try like this: length increases password security much more than the security decrease caused by having the password easy to remember, meaning that long easy-to-remember passwords are more secure than short difficult-to-remember passwords –  Andreas Bonini Jan 31 '13 at 12:38
add comment

3 Answers

up vote 14 down vote accepted

Such passwords will be as random as your fingers can be. Humans banging on keyboards tend not to be very random; for instance, they will often alternate between left-side keys and right-side keys. As a rule of thumb, such a passwords would probably be reasonably secure if you make it long enough, about twice as long as a random password generated with a good randomness generator.

The main problem with a password crafted with such a "manual process" is that it is very hard to quantify its randomness. Especially if you generate several such passwords: I would expect successive "keyboard-random" passwords from the same human user to exhibit similarities. Thus, you have to overdo it in order to regain some guarantees, which means longer passwords (and nobody likes to type long passwords).

I recommend using a strong random generator. Dice will do; coins too (but a d20 will give you more randomness per throw than a coin). If you happen to have a computer available at that time, well, it can be used too.

share|improve this answer
8  
A typical desktop computer is far too asymmetric to generate anything approaching a normal distribution of rolled like a die; laptops might be close enough to constant density to flip like coins though while still getting reasonablish resuts. –  Dan Neely Jan 30 '13 at 19:06
    
please don't throw your Desktops/laptops into the air, send them to me instead! good answer! –  Malachi Jan 30 '13 at 20:39
    
@DanNeely , Laptops are usually heavier on the side that has the CPU's heatskink and the battery and sometimes the Harddisk is heavy too, also the top is lighter due to the LCD usually being very light. never the less, point well taken. –  sharp12345 Jan 31 '13 at 0:15
    
@sharp12345 good point. I wonder if tablets would work better. Current models are mostly battery inside so should be somewhat more consistent in density. –  Dan Neely Jan 31 '13 at 15:04
add comment

You should try your method of random typing and generate 100 random strings and then analyze them and check if you find the pattern. Most likely, you will see that the strings are not that random.

It is best to use a random number generator. Whatever operating systems you are using, there are libraries that allow generation of random data. Trying to generate random data by hand is a bad idea.

Here is an interesting article about random numbers generated by humans.

share|improve this answer
1  
With common ancestry in mind, the article you link to puts a new spin to the Infinite monkey theorem. Love that! :) –  TildalWave Jan 30 '13 at 21:38
add comment

using a computer generated Number/password could have Drawbacks in that a computer cannot generate a completely random set. it has to be based on something to give it a starting point, so eventually the pattern will repeat, although with the way technology is going we are getting better at using infinite non-repeating decimals in the calculations for randomness which throw a curve ball into the mix of predictability.

by a general rule a Computer cannot make a decision by itself, it cannot be completely random. A Human on the other hand can be random. i.e. decide between 10 numbers without external input or logic dictating what he/she "should" pick.

share|improve this answer
    
Actually, in practice computer generated passwords are more random than people smashing their keyboards as demonstrated by the study linked in Dinu Smădu's answer.. of course seeding the random generator with user input gives one of the best randomness possible, but at this point I think we are going a bit off topic since the answer doesn't ask this –  Andreas Bonini Jan 30 '13 at 21:00
    
Random sort of equates to secure. if the password cracker is set for common words it will waste it's time trying to find words first, if it is set in the opposite and the password has words in it, it is not at a loss because words are "randomly" placed leters, spaces, punctuation. if the cracker program is only looking for english words and you have a spanish word there, than the cracker will not test that sequence. if you create a phrase it would be easier for a human to crack through social engineering or other methods. –  Malachi Jan 30 '13 at 21:22
    
besides that test was done using only 9 different characters. not 94 characters (rough Estimate if all special characters on a common qwerty keyboard are accepted in the password) based on the OP's question of adding in special characters and upper/lower case alpha, the 'distance' they speak of would change. the possibility that someone could randomly create a seemingly infinite non-repeating decimal (or start of) is possible. –  Malachi Jan 30 '13 at 21:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.