26

While messing around with the Cygnius Password Strength Test I noticed that if you enter a sequence like

wsdxcv

the test labels it as a "spatial" pattern — obviously because the keys are close together on a qwerty keyboard, if on different rows.

Googling around I can hardly find any mention of the idea, and I can't imagine it'd be especially common anyway (outside of one-handed passwords). Plus there may be multiple keyboard layouts to consider.

So the question is, are cracking algorithms actually likely to take this pattern into consideration?

  • 2
    It's not as uncommon as you want to think. I've seen it for production accounts. – jpmc26 May 29 '17 at 7:00
39

This method of creating a password by pressing adjecant keys is called a keyboard walk. Password crackers kind of take this into account; they don't explicitly try keyboard walks, but the most common keyboard walks are contained in password dictionaries. So crackers will test for qwerty, not because it is a keyboard walk but because it is a common password.

There are some tools to create dictionaries with password walks:

  • HashCat's kwprocessor, a keyboard-walk generator with configureable basechars, keymap and routes.
  • passpat can identify passwords that are keyboard walks.
  • Generating Keyboard Walks, a blog post and software to create keyboard walks.
  • Nice to know there's another name for this pattern. Good answer, useful references. – Cauterite May 28 '17 at 8:41
  • 10
    I can also say, from personal experience, that keyboard walks are probably the easiest sort of password to shoulder surf. – Tacroy May 29 '17 at 1:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.