0

Some password management applications suggest strong passwords formed by groups of random words stringed together with a simple delimiter. For example:

duplicate.aught.cavemen.length

In contrast, I believe that a suggestion based on groups of four digits is not as noisy (important when trying to read and type the password), easier to support (no need to research and maintain a dictionary), and just as secure in practice. For example:

1202.8746.9173.0953

The alternative shown, is equivalent to stringing four random words extracted from a 10,000-word dictionary to which everyone has access.

As presented, an attacker who is neither lucky nor unlucky would need to check about 158 million guesses per second to crack the password in one year.

Provided that both are generated using a cryptographically-secure RNG and persisted using a strong key derivation function, would you have any reason to prefer a dictionary-based policy over a random-digit policy?

Improve this question

1 Answer 1

Reset to default
2

The "phrase of random words" is much easier to remember

The text duplicate.aught.cavemen.length is easier to remember than 1202.8746.9173.0953. The problem with the latter is that you need to remember the right digits in a search space where there's no meaning attached to it (Was it 9173 or 9174?). You can have some doubts with the words (perhaps trying cavemen or troglodyte), but in the end, the familiar dictionary makes it is easier to remember.

Improve this answer
4
  • I don't think I value password memorability anymore (with so many, I cannot even hope to remember a fraction of them). Instead, I'm inclined to prefer ease of reading them quickly. Also, the memorability depends on the user's native language (mine, for example, is not English), and addressing the language issue would entail managing different dictionaries, and potentially deal with encodings (e.g., whether to use accents, non-ascii characters, and so on). That is, in fact, why I originally started thinking about alternatives to the random-word approach.
    – Escualo
    Commented Feb 20, 2018 at 22:40
  • 1
    You need to remember a single strong password - the one that unlocks your password manager. All the other passwords don't need to be memorable because the password manager can remember them for you. But I for one would prefer memorizing a sequence of random words over a sequence of random numbers.
    – Out of Band
    Commented Feb 20, 2018 at 22:55
  • Yep. A handful of master unlocking passwords is all I know.
    – Escualo
    Commented Feb 20, 2018 at 23:00
  • Communicating a password to another human over a phone is also less ambiguous with numbers. "Was that second one 'ought' or 'fought'?" I'm doubtful there is a good use case, but I have plenty of examples.
    – user123931
    Commented Feb 20, 2018 at 23:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .