8

How secure is it to generate random strings/passwords manually for different purposes by just clicking randomly on the keyboard ?

I usually need random strings for salts and for passwords, and I wonder if that method is sufficient or not, or do I need a strong algorithm to generate the passwords for me.

Assuming that I will include numbers and maybe special characters and small/capital letters

Improve this question
5
  • 6
    This is not an answer per-se so I'll post as a comment, but I think you are doing it wrong. The difficulty of guessing a password increases much more rapidly with length than with randomness. The password "Passwords that are phrases are easy to remember, and very secure -- people should use them more" is infinitely harder to guess than "s1DRyYbCDgjXE" and much much easier to memorize. So don't focus on having random passwords, focus on having long passwords. The same goes with salts.
    – Andreas Bonini
    Commented Jan 30, 2013 at 15:51
  • 1
    @AndreasBonini Technically, the longer password isn't infinitely harder. But based on the results from howsecureismypassword.net, it's about 4.7e160 times stronger, which I think is pretty close to infinity ;)
    – Matthew Crumley
    Commented Jan 30, 2013 at 19:05
  • 1
    @AndreasBonini I think this XKCD comic explains it nicely.
    – Petr
    Commented Jan 30, 2013 at 20:24
  • @AndreasBonini: on the contrary: randomness is everything. Having a long password is just an easy way to get more randomness in the situation where the password "makes sense" for a human, with very little additional randomness per character. You have to focus on long passwords when the password generation process is not very random (e.g. it was performed by a human in his mind).
    – Thomas Pornin
    Commented Jan 31, 2013 at 12:07
  • @Thomas: well, taking what I said very literally you are right, but you know what I meant ;) Let's try like this: length increases password security much more than the security decrease caused by having the password easy to remember, meaning that long easy-to-remember passwords are more secure than short difficult-to-remember passwords
    – Andreas Bonini
    Commented Jan 31, 2013 at 12:38

3 Answers 3

Reset to default
16

Such passwords will be as random as your fingers can be. Humans banging on keyboards tend not to be very random; for instance, they will often alternate between left-side keys and right-side keys. As a rule of thumb, such a passwords would probably be reasonably secure if you make it long enough, about twice as long as a random password generated with a good randomness generator.

The main problem with a password crafted with such a "manual process" is that it is very hard to quantify its randomness. Especially if you generate several such passwords: I would expect successive "keyboard-random" passwords from the same human user to exhibit similarities. Thus, you have to overdo it in order to regain some guarantees, which means longer passwords (and nobody likes to type long passwords).

I recommend using a strong random generator. Dice will do; coins too (but a d20 will give you more randomness per throw than a coin). If you happen to have a computer available at that time, well, it can be used too.

Improve this answer
4
  • 11
    A typical desktop computer is far too asymmetric to generate anything approaching a normal distribution of rolled like a die; laptops might be close enough to constant density to flip like coins though while still getting reasonablish resuts.
    – Dan Is Fiddling By Firelight
    Commented Jan 30, 2013 at 19:06
  • please don't throw your Desktops/laptops into the air, send them to me instead! good answer!
    – Malachi
    Commented Jan 30, 2013 at 20:39
  • @DanNeely , Laptops are usually heavier on the side that has the CPU's heatskink and the battery and sometimes the Harddisk is heavy too, also the top is lighter due to the LCD usually being very light. never the less, point well taken.
    – sharp12345
    Commented Jan 31, 2013 at 0:15
  • @sharp12345 good point. I wonder if tablets would work better. Current models are mostly battery inside so should be somewhat more consistent in density.
    – Dan Is Fiddling By Firelight
    Commented Jan 31, 2013 at 15:04
11

You should try your method of random typing and generate 100 random strings and then analyze them and check if you find the pattern. Most likely, you will see that the strings are not that random.

It is best to use a random number generator. Whatever operating systems you are using, there are libraries that allow generation of random data. Trying to generate random data by hand is a bad idea.

Here is an interesting article about random numbers generated by humans.

Improve this answer
1
  • 1
    With common ancestry in mind, the article you link to puts a new spin to the Infinite monkey theorem. Love that! :)
    – TildalWave
    Commented Jan 30, 2013 at 21:38
2

using a computer generated Number/password could have Drawbacks in that a computer cannot generate a completely random set. it has to be based on something to give it a starting point, so eventually the pattern will repeat, although with the way technology is going we are getting better at using infinite non-repeating decimals in the calculations for randomness which throw a curve ball into the mix of predictability.

by a general rule a Computer cannot make a decision by itself, it cannot be completely random. A Human on the other hand can be random. i.e. decide between 10 numbers without external input or logic dictating what he/she "should" pick.

Improve this answer
3
  • Actually, in practice computer generated passwords are more random than people smashing their keyboards as demonstrated by the study linked in Dinu Smădu's answer.. of course seeding the random generator with user input gives one of the best randomness possible, but at this point I think we are going a bit off topic since the answer doesn't ask this
    – Andreas Bonini
    Commented Jan 30, 2013 at 21:00
  • Random sort of equates to secure. if the password cracker is set for common words it will waste it's time trying to find words first, if it is set in the opposite and the password has words in it, it is not at a loss because words are "randomly" placed leters, spaces, punctuation. if the cracker program is only looking for english words and you have a spanish word there, than the cracker will not test that sequence. if you create a phrase it would be easier for a human to crack through social engineering or other methods.
    – Malachi
    Commented Jan 30, 2013 at 21:22
  • besides that test was done using only 9 different characters. not 94 characters (rough Estimate if all special characters on a common qwerty keyboard are accepted in the password) based on the OP's question of adding in special characters and upper/lower case alpha, the 'distance' they speak of would change. the possibility that someone could randomly create a seemingly infinite non-repeating decimal (or start of) is possible.
    – Malachi
    Commented Jan 30, 2013 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .