Source code as password

Question

Passwords with a mixture of letters, numbers, and special characters are sometimes hard to remember. Is it secure to instead use a small amount of memorable source code as a 'passphrase'?

As an example, take a simple for loop in Go: fori:=1;i<5;i++{fmt.Println(i)}

Normal people would only see the cryptic syntax, but as a person with a programming background, this may be more easy to memorize. Would it be at least as secure as a normal password?

Answer 1

You can use source code as password.

However I'd strongly recommend against using source code as a passphrase.
The reason for this is entropy.
Passwords / passwphrases need to provide lots of entropy (100 bits+) and programming languages usually pose severe constraints on the formulation of instruction thus resulting in less entropy per character than even with a standard passphrase.

What may be possible aside of that, you can use source code files (100 lines+) with lots of complex instructions and non machine-codable as keyfile.

Answer 2

Like most password generation algorithms, this one relies on security through obscurity.

As long as nobody suspects that you use this method, nobody will use a cracking tool which tries random valid source code snippets and the rule of strength = possible_characters ^ number_of_characters will stay valid. But as soon as someone suspects that you might be using it, or when it even becomes a common method because you start advertising it as "a very good idea" on a website, this would change.

As soon as someone feels compelled to write a tailored cracking routine, you have to look at how much entropy there really is in your sourcecode. And when you are limited to "small, memorable code snippet in common programming language", you are maybe down to a few billion possible passphrases, which is not enough to withstand a serious brute-force attempt.

Answer 3

It's best to use a method that would stay secure even if everyone used it. You'll have less to worry about and it lets you collaborate with others in tweaking the method to be the most secure, because you don't have to keep your methods secret.

This "the enemy knows the system" approach is a huge motor for innovation and advancement in information security. Otherwise you'd have independent groups that each work on their own obscure, supposedly unexpected designs and principles.

Furthermore, you have no way to quantify how secure your system is because it all depends on psychology and what others know about you.

In some walks of life you need to be creative and build your strategy on some personal, unique insight that you have to keep secret, but information security is not like that.

Answer 4

At first glance, this seems like it might be a good idea. Like many suggestions relating to passwords, in some situations it may even be an OK solution. However, when you consider it in more detail, a number of shortfalls become evident.

If I was trying to crack someones password, one of the first things I would do is try to find out as much information about the person as possible. If I know you are a programmer, then I may well take a guess that you use some code for your passphrase. I've now narrowed down the possible search space.

If I know what your preferred programming language is, I've now reduced the search space even further. I only need to consider legal forms from your preferred language.

Now when I consider the legal forms which are allowed in your preferred language, I've reduced the search space even further. If there is a known maximum character limit for the passphrase, that search space is even smaller again - in fact, for most languages, there will only be a very small set of possible legal forms which will fit in to the allowed character limits for many passwords.

As indicated by other answers, the real problem with 'clever' password/passphrase schemes is that they rely on others not being able to guess what your scheme is. As the popularity of a scheme increases, the benefit of that scheme reduces. Above all, any scheme you choose needs to be something which is not easily associated with you.

The other problem with clever password schemes is that they are rarely as clever as you think theyy are. If you analyse passwords dumped from stolen password repositories, you will be surprised how 'common' many of these clever schemes are. You may also be surprised how often the clever scheme is related to the domain the passwords came from. For example, I saw passwords stolen from an Air Force system and guess what, the vast majority of passwords were either derivations of various aircraft names and model numbers or character names from movies or books with a military or air force theme. Likewise, passwords dumped a couple of years ago from a christian dating sight had large numbers of passwords which included phrases, chapter and verse numbers from the bible. If I was going to try and crack github passwords, I would almost certainly look at code as a possible pattern.

The one minor benefit of using code is that you will likely have a longer password/passphrase, which is often as important or more important as the underlying complexity. Too often, people use short passwords because they are easy and quick to type. These days, I think most people are far better off ensuring that they use either 2 factor authentication or 2 step authentication whenever possible and use a password manager which will generate random passwords for you and in most cases, eliminate your need to remember them.

Answer 5

TLDR; The entropy of one Code-Token is 4 Bit, which is way to less

I'm actually confused, that no one tried to measure the entropy of code, it's actually very easy. I used this Python-code:

import os
from os.path import join
from multiset import Multiset
import re
import math

with open("keywords.txt", mode="r") as f:
    keywords = f.read().split("\n")
tokens = Multiset()
split_regex = re.compile(r"\s+")
for path, folders, files in os.walk("vscode"):
    for file in files:
        if file.endswith(".ts"):
            filepath = join(path, file)
            with open(filepath, mode="r", encoding="utf-8") as f:
                content = f.read()
            split_res = split_regex.split(content)
            keywords_res = [keyword for keyword in split_res if keyword in keywords]
            tokens += Multiset(keywords_res)
total_nr = sum(tokens.values())
total_tokens = len(tokens.values())
print(total_nr, total_tokens)
assert total_nr > total_tokens
total_entropy = 0
for value in tokens.values():
    p = value / total_nr
    total_entropy += -p * math.log2(p)
print(total_entropy)

it gave me an entropy of exactly 4.047718782037269 (keep in mind limited machine precision) on the Code of VS-Code with the following keywordlist:

break
as
any
switch
case
if
throw
else
var
number
string
get
module
type
instanceof
typeof
public
private
enum
export
finally
for
while
void
null
super
this
new
in
return
true
false
any
extends
static
let
package
implements
interface
function
new
try
yield
const
continue
do
catch
;
=
+
-
*
/
<
>
!
?
:
,
.
[
]
{
}
(
)
"
'

of the following commit: https://github.com/microsoft/vscode/commit/c5702cdc190d0026457f43ae547cf66a1a15b7dd`` at first, I calculated the entropy without the whitelist but it contained a lot of comments and variable names and I got 12 Bits of Entropy. I don't think it makes sense to include them, because there are no naming rules which makes it easy to remember, then you could immediately use a usual password.

Keep in mind, that this is just an upper bound because there are more rules. My calculation assumes the keywords are coming independent from each other, which they are not.

Answer 6

Use Malbolge. After all that's essentially random, right?

(=<`#9]~6ZY32Vx/4Rs+0No-&Jk)"Fh}|Bcy?`=*z]Kw%oG4UUS0/@-ejc(:'8dc

That's the hello world program.

Answer 7

This is actually a very good idea. You won't find this kind of passwords easely in rainbowtables, and most bruteforce attacks don't include characters like this or search for such long passwords.

Its only weakness is the fact that it is a short code (not a short password), if someone knows you have a script as password it could be easy for them to guess. This is assumed by above answer by SOJPM.