Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is difficult to type on a smartphone.

I normally use Last Pass on my computers, and let it generate long passwords with a mix of letters, numbers, and symbols. For example: "5&8fjmYyb4^Vd2n". Since I never have to read or type these passwords, they can be anything.

There is a Last Pass app for just about every platform out there (cool). The one for Android is basically a web browser. If I want to log in to, say, http://amazon.com, it can fill in my credentials. But Amazon also has a few apps: Kindle, MP3 Cloud player, App Store, etc. These apps have their own login screens.

To run the Amazon Kindle PC software, I can use Last Pass to copy my Amazon password to the clipboard, then paste in to the Kindle software login screen. However, copy/paste and switching between apps on Android is clumsy. It's better than typing "5&8fjmYyb4^Vd2n" but it still is a pain.

Two other obvious examples are the Twitter and Facebook apps. There are many more.

My phone has a slide-out keyboard, so digits and lowercase letters are easily accessible. Uppercase and some symbols (those on the numbers) are harder to get to. Other symbols are very difficult, as you have to navigate UI to look for them.

Similarly, the Kindle has a keyboard and a web browser. Both are hard to use, but sometimes they're just the ticket. There is no Last Pass for Kindle.

Ideally, I'd like a way to come up with strong, easy-to-remember passwords that are also easy to type on these hard-to-use devices.

share|improve this question
2  
What are you using the password to protect? What model or type of smart phone? Does it have a slide out thumbboard? Are alternate authentication mechanisms such as speech and facial recognition possible? –  this.josh Aug 11 '11 at 7:51
    
@this.josh: good questions. In this case, my phone has a slide-out keyboard, but I'm hoping for a more general solution. –  Jay Bazuzi Aug 11 '11 at 17:24
    
I think a general solution will not achieve a strong password that has high usability for a general device. This is because the class of general smartphones has great variety in the user inferface both physicaly and logicaly. The best way to approach a problem of a variety of devices is to use a external component. I would suggest something like a microSD hardware security module. –  this.josh Aug 11 '11 at 21:41
    
My phone has a handwriting recognition system on it which I use for entering characters that are not on my touchscreen keyboard. In particular I use this for entering Chinese text in my emails/texts. Is a similar handwriting app available on your phone? –  Rincewind42 Aug 12 '11 at 3:56
    
@JayBazuzi, Why not simply make a strong one and commit some time to muscle memorize it? (it's your password afterall) I don't actually know my password by heart, but my fingers know where they need to go. –  Pacerier Jul 17 '12 at 20:59
show 2 more comments

5 Answers

You actually already have part of the answer: to make it easy to type, use only lowercase letters.

Now the trick is to know how many letters to use. If you want, e.g., 40 bits of entropy (a quite high goal for a password), then you must accumulate at least x letters such that 26x > 240 (i.e. 9 letters). 9 letters are sufficient if they are chosen uniformly, randomly and independently from each other; do not try to do it in your head, the human brain is a terrible RNG. Instead, use a good RNG (coin flips, dice, a computer with /dev/urandom...) and, that's the important bit, stick to the result: you get your 9 letters, accept them and learn them.

If you want to have a password that you can "easily" memorize then you need more letters. For instance, you could generate 100 sequences of 10 letters, and keep the one which pleases you most; since 2610 > 100*240, you still get your 40 bits of entropy.

See this question (in the crypto-specific stackexchange site) for details on the involved mathematics.

share|improve this answer
3  
I've done a simple web application inspired from your post. codingtony.com/lc_passgen –  Tony Feb 26 '12 at 19:08
add comment

Hmmm, it seems you have already considered that know-it-all horse. In my experience, that (lowercase pass-phrase of multiple words) is the easiest option without a special app - each operation gets you one additional character (as opposed to special chars, where multiple operations get you one character).

Apart from that, there's a (cross-platform) app named Keepass, also available for Android (free, for 1.5+, IIRC); I'm using the clipboard to ferry passwords to and fro, clearing it afterwards - thus the annoyance of password management is independent of password length and type, allowing for arbitrary password length. I'm also using Dropbox to sync the (encrypted) password file with my desktops.

share|improve this answer
3  
Side rant: anyway, some services cough Skype cough are still enforcing a ridiculously tiny maximum password length, rendering any attempts at reasonable password entropy moot - what are they doing, storing the damn plaintext? (I see no other explanation) –  Piskvor Aug 11 '11 at 9:53
    
I would ditto Piskvor suggestion of using a password manager. He suggests Keepass, I've also used Keepass as well as Lastpass and Roboform, each of which support mobile apps. This will allow you to keep passwords complex without worrying about typing them in. However, you still have to key a master password to start the password manager app. –  Rincewind42 Aug 12 '11 at 3:51
    
@Rincewind42: Indeed, but memorizing one good password is easier than memorizing many; thus you can have a more complex master password (e.g. eight words, interspersed with numbers and special characters). At that point, of course, the Rubber-Hose algorithm becomes an easier method of cryptanalysis. –  Piskvor Aug 12 '11 at 7:35
add comment

What I do on a Blackberry (because I got annoyed with the multiple keypresses to select a symbol or different case etc.) I use a long password that I don't actually know. I just know the shape of it on the keyboard.

It might have upper or lower case or symbols - I'd have to check to actually find out:-)

share|improve this answer
add comment

Markus Jakobsson and Debin Liu have proposed an intriguing approach to password authentication on smartphones. Their proposal is basically to take any ordinary password, and then map its first four characters to a 4-digit PIN by using the standard telephone mapping (e.g., ABC -> 2, DEF -> 3, etc.).

Their approach generates a 4-digit PIN. This has advantages and disadvantages:

  • The primary advantage is usability: it is easy to enter on your phone. This is likely to be a huge benefit for many users.

  • The primary disadvantage is, obviously, security: a 4-digit PIN is easier to guess. It is application-specific whether a 4-digit PIN is adequate. Obviously, for a 4-digit PIN to provide good security, the web site needs to take various steps to deter random password guessing, including limits on the rate at which an attacker can try passwords or limits on the number of incorrect password attempts that are allowed. However, their paper argues that if these appropriate steps are taken, their scheme can provide adequate security for many purposes.

I encourage you to read the paper and form your own opinion about whether it is appropriate for your needs.

share|improve this answer
add comment

You may like this xkcd comic.

correct horse battery staple

share|improve this answer
    
For whoever downvoted me: I'm being serious here. I don't just think it's funny. Randall makes a very good point. Four random words is easier to use, easier to remember and stronger than "conventional" passwords that you assume are strong. If I'm wrong, prove it mathmatecally. –  bahamat Aug 14 '11 at 22:38
    
I agree and I am going to be implementing this in a few spots where I can't easily copy/paste passwords from LastPass. +1 for the answer. –  Mike Wills Aug 15 '11 at 18:03
1  
Very nice, but it's actually referenced in the question, so I don't see what it adds as an answer. –  TRiG Aug 22 '13 at 17:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.