Will typing my password twice make it more secure? Or typing each character twice?

Question

If I type my password twice (like: PwdThingPwdThing), OR type every character twice (like: PPwwddTThhiinngg) will that make it substantially more secure than it already is?

Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.

(Also assume that I didn't tell anyone that I am doing it this way, although I just told the world... Doh!)

I ask because I would like more security in a way that I can still remember, and this would be an easy change to make and recall.

Answer 1

Let's try skipping theory and going straight to practice.

Will typing the same word twice (or N times) substantially help?

• John the Ripper Jumbo has a variety of "simple rules" about this

  • d duplicate: "Fred" -> "FredFred"

  • f reflect: "Fred" -> "FredderF"

• oclHashcat rules based attack has simple rules just for this, too

  • d Duplicate entire word d p@ssW0rd p@ssW0rdp@ssW0rd

  • pN Append duplicated word N times p2 p@ssW0rd p@ssW0rdp@ssW0rdp@ssW0rd

  • Reflect f Duplicate word reversed f p@ssW0rd p@ssW0rddr0Wss@p

• Therefore, no, this bit of cleverness is so common it's included explicitly in both common rulesets already for use by itself, or in combination with other rules.

OR type every character twice

• John the Ripper Jumbo has an example specifically about this in the documentation

  • XNMI extract substring NM from memory and insert into current word at I is the core rule

  • "<4X011X113X215" (duplicate every character in a short word) is the example in the documentation to cover exactly your case for short passwords

.

• oclHashcat rules based attack has simple rules just for these kinds of attacks

  • q Duplicate every character q p@ssW0rd pp@@ssssWW00rrdd

  • zN Duplicates first character N times z2 p@ssW0rd ppp@ssW0rd

  • ZN Duplicates last character N times Z2 p@ssW0rd p@ssW0rddd

  • XNMI Insert substring of length M starting from position N of word saved to memory at position I lMX428 p@ssW0rd p@ssw0rdw0

• Therefore, no, again, this is such a common bit of cleverness that it's called out explicitly in both major open source cracking products.

Assume that it is already 8 or 9 characters, consisting of upper and lower case, digits and one or more special characters.

The other rules in those products very likely cover everything you're doing already, and it's also likely that whatever combination you have is already included in a ruleset applied to a reasonable cracking wordlist.

• oclHashcat alone comes with twenty five different files full of .rules, including d3ad0ne.rule with more than 35,000 rules, dive.rule with over 120,000 rules, and so on.

• a large number of wordlists are available, some of which may include your exact password - the Openwall wordlist alone has a single 500MB file of more than 40 million words including mangled ones

• and I'm personally aware of both small, very good wordlists (phpbb, et all) and huge, comprehensive wordlists with literally billions of entries, taking up many gigabytes of space total.

As with everyone else, you need to use try randomness or something like an entire sentence worth of personal anecdote that does NOT use words in a top 5000 list of common English words, and does use long, uncommon words (to force combinatorial attacks using much larger dictionaries).

Specifically look, for example, for words selected at (good) random included in Ubuntu's insane english ispell dictionary list that are not included in the standard english ispell dictionary, for example.

Answer 2

Security.StackExchange is full of questions proposing "home-brew" password strategies. The short answer is always the same: doing something to differentiate your password from the standard dictionary attacks is good - as long as

1. Very few other people on the planet are also using your strategy. If your "home-brew" strategy turns out to be common - like replacing 'a' with '@' - then it'll get included in the standard dictionary attacks and you're back to square one.

2. You're not being personally targeted. If you are enough of a high-value target that attackers are specifically trying to break your account, then any pattern you use is a liability because once they know your pattern (say from your leaked passwords from previous leaks) then they'll build dictionaries based on your pattern.

Another trend with this type of question here on infosec, is that someone inevitably references XKCD, so here goes. Remember that computers are good at searching databases and generating lists based on patterns. By using a simple strategy like "doubling every letter", or "the initials of the chorus of my favourite song", etc, you are using a strategy that's easy for computers to guess. The best practice for coming up with a simple password strategy is always: don't. Use a password manager like LastPass to generate and remember a 32-char random password for you. If you insist on having something that you can memorize, then the next best practice is diceware.

If you want to defy all best-practices and invent your own scheme, then I would recommend something emotion-based rather than pattern-based, or something that can be mined out of your personal information. For example a password based on "websites I like", or "TV shows I watch" would be easy to guess for anybody with access to your internet activity, but "things that remind me of ______" where you pick a very different ______ for each password could be hard to guess. (If I thought about this scheme a bit longer, I could probably argue that even this is easy enough to guess, but the point is that it's still better than something purely pattern-based.)

Answer 3

In general, no, doubling the password does not substantially increase (or decrease) your security. What it doubles is your typing effort. Doubling your password may decrease your security if it incites you to choose a shorter/easier base password so that your typing effort is not too cumbersome.

In broad terms, password security comes from its randomness, i.e. how much the attacker does not know. In the case of "doubling", this is a one-bit information (i.e. whether you applied it, or not), so, mathematically speaking, it is one extra bit of entropy. That's not much. Typing eight extra characters to gain a single bit of entropy is meagre; this is not a good bargain.

All witty tricks share the same fundamental problem: they are witty. They rely on the attacker being stupid, incompetent or archaic. This does not hold in practice, except against attackers who really are stupid, incompetent and archaic -- the gods know that they are many of them, but they are not a big problem, because they would not know what to do with your password. The attackers that you should worry about are the smart ones, who can enact substantial damage to your digital assets in a short time; these smart attackers won't be much deterred by your password doubling trick.

Consider reading this famous question to get some information about what makes a password "strong", in particular the entropy maths in that answer.

Answer 4

My password cracker already tries letter doubling, word doubling, word reversing and doubling, word-case-flipping and doubling...

...and many more.

Yep. Doubling adds some to the difficulty: about four bits worth, tops. It'd take me sixteen times longer to crack, than a raw dictionary attack with letter replacements.

But I'd eventually get BAdpA55!!22AqbA8.

Answer 5

Humans are surprisingly predictable creatures. The way we think is not nearly as unique as we would like to believe. Chances are, any clever thing you can think of to make your password more secure, has already been thought of by lots of other people, and hackers are well aware of all of these clever tricks.

The only way to make a password properly secure, is to make it long and random. Remove the human fallibility from the equation. If a password is so complex you can't possibly memorize it, then it may be secure enough.

Password managers are extremely helpful. They allow you to make every password you use unique, and every password completely random.

You obviously need to ensure that your password manager database is secure though, and cannot be accessed remotely.

Answer 6

There are a lot of factors but it ultimately breaks down to what type of password cracking are you trying to protect against. Against a brute force hack increasing the length of the password will make it harder to crack. Assuming their hashing isn't horrible a decent 8 or 9 character password should already be very hard to impossible to brute force crack. That means doubling it by typing each character twice or typing the same password twice really doesn't do much.

Once your password is long enough to be safe against a brute force attack then you have to start worrying about dictionary attacks, combination attacks and other things like that. Either of the things you suggest would be easy to include in a rules based attack and any value in additional security from that is depending on it not being commonly done and not being included in their set of rules.

Answer 7

Link to zxcvbn password entropy demo.

According to zxcvbn, your initial password's stats:

Normal: PwdThing

 Guesses:
    100 / hour:     5 months    (throttled online attack)
    10  / second:   58 minutes  (unthrottled online attack)
    10k / second:   35 seconds  (offline attack, slow hash, many cores)
    10B / second:   less than a second  (offline attack, fast hash, many cores)

Doubled: PwdThingPwdThing

guess times:
100 / hour:     9 months    (throttled online attack)
10  / second:   2 hours (unthrottled online attack)
10k / second:   1 minute    (offline attack, slow hash, many cores)
10B / second:   less than a second  (offline attack, fast hash, many cores

Letter Doubled: PPwwddTThhiinngg

guess times:
100 / hour:     centuries   (throttled online attack)
10  / second:   centuries   (unthrottled online attack)
10k / second:   centuries   (offline attack, slow hash, many cores)
10B / second:   12 days (offline attack, fast hash, many cores)

zxcvbn might not be perfect, but I feel like it gives you a pretty good ballpark estimate of your password strength. Play around with it to get a nice memorable password with a high rating.

I prefer sentences to use as passwords. They're long, and inherently difficult to guess and easy to remember.

EX: "My 2nd favorite fruit, on Mondays, is mango!" (spaces included where allowed)

If you're worried about the NSA brute forcing your password... I'd go with the generated passwords everyone else is talking about.

Answer 8

Two things make a password more secure: Length and randomness. So, the answer to your question is definitively Yes, you are increasing security of your password.

But in general, your initial password is not super secure because it uses words that can be found in a dictionary. And, the doubling is just a repetitive pattern that an cracking algorithm can easily do to too. So, not only double your password, make sure what you double aren't actual words.

Answer 9

adding length to a password does substantially increase the security of a password so I think typing your password twice or doubling every character is better than not doing it and using a shorter password of 8 or 9 characters. Refer to this link to read more about how increasing password length significantly improves its security: https://www.grc.com/haystack.htm

Answer 10

The length of the password is always a key factor in password security but try to improve the content also, doubling the password may help against the pratice with HYDRA/Dictionary attacks

Answer 11

@SethWhite - believe you have given the most accurate answer.

Many users don't understand the avenues and methods used to break a password. Also there are additional security measures such as port blocking for unknown http/ftp callers. Someone better versed should explain.

Seth shows that there are at lease four different avenues to breaking a password the hard way. Easiest way is to Phish, look under keyboard, sticky notes on monitor for slip of paper etc.

Passwords are only part of what is protecting your data from attack. Your password(key phrase) is used to generate a random long binary(machine code) sequence that can only be decoded with your password and the sofeware algorythm that encoded it. So anyone just trying to guess this binary sequence (HASH) on the base data (without using the decoder software that a login page uses) will have to try randomly starting with the first byte until they randomly guess all bytes. This is what Seth shows as Brute force and you need lots of time and many cores for 64,128,256,512 byte HASH lengths. Time to hack goes up exponentially with length. The HASH length is based on the password size so longer password longer HASH longer brute force time.

I believe Wikileaks took many months to break the code but most HASH can be broken. I would think the data-service center hacks were dictionary attacks where the hacker used the login decoding software to guess the passwords. Dictionary attacks therefore usually have some kind of access to the system your data is on not just the data.

Fore instance as I understand the throttled online attack picks away over an http connection, possibly supported by a hacked cookie(small usually helpful program installed by web-servers) to "Dictionary attack your system".

Conclusion: long random passwords ("PPwwddTThhiinngg" counts) help a great deal to stop both kinds of attacks. Password length and complexity should reflect the danger to dictionary attacks and sensitivity to the information stored.

P.S. My family hates me because our home-wireless-network is protected by a 128 byte random key-phrase.