Would a password saved on paper written in a personal writing system be decipherable?

Question

A while ago I created a small writing system to write personal notes, it was more an experiment to see if I could make one and then memorize it.

Seeing as nobody else knows how it works, I created a random password of about 20 characters, and wrote this down on a piece of paper, then I sent a picture of that piece of paper to a close friend of whom I am sure doesn't ever lose her photos. I also saved one in Google Photos.

I don't trust password managers since KeePass which is (at least used to be) recommended a lot is crack-able.

Would it be possible for anyone to crack that?

I hope this isn't an incredibly dumb question, I personally can't come up with any way it would be possible to crack this, but I want to be sure.

Answer 1

I hope this isn't an incredibly dumb question, I personally can't come up with any way it would be possible to crack this, but I want to be sure.

Being unable to come up with a way to crack your own invention isn't generally seen as an indicator for quality in security circles.

Would it be possible for anyone to crack that?

That depends very much on how your personal writing system works, and how much additional text in this writing system is available to an attacker.

Your question is basically a cryptography question: You have a script no one except you knows, and you want to know whether it's decipherable. There are some historic parallels; for example, Linear A is an ancient writing system that remains mostly a mystery. And if you visit the British Museum, you'll see the Rosetta stone, without which we might not be able to read Egyptian hieroglyphs today.

Assuming your writing system simply replaces letters, or maybe syllables, with your own symbols, it should be fairly easy to crack given a few pages of text written in it. A simple frequency analysis would probably be enough to crack it.

However, if the only thing your attacker has is the picture of your password in your writing system, and the password is random (e.g. not a known word), then I'd say chances of successful cracking are slim. This is because unknown writing systems and ciphers are often cracked because the people working on it make correct guesses about context, and if there is no context, this doesn't work.

What could be problematic is that because a good writing system is designed to be useful, you might have made an 'e' simpler to write than, say, a 'q'. So it might be possible to make some guesses as to which symbol corresponds to which actual letter, which would reduce the number of password guesses an attacker might need to make (e.g. if he correctly assumed that the fourth letter was an 'e' and the seventh was a 't', maybe based on the shape of your symbols, he'd reduce the time needed to find the correct password by brute force (trying every possible combination of characters) by about three orders of magnitude.

Answer 2

Of course it's possible for someone to crack it. As Pascal notes above "Being unable to come up with a way to crack your own invention isn't generally seen as an indicator for quality in security circles."

This quote from Phil Zimmerman's book "Introduction to Cryptography" is a great example:

When I was in college in the early 70s, I devised what I believed was a brilliant encryption scheme. A simple pseudorandom number stream was added to the plaintext stream to create ciphertext. This would seemingly thwart any frequency analysis of the ciphertext, and would be uncrackable even to the most resourceful government intelligence agencies. I felt so smug about my achievement.

Years later, I discovered this same scheme in several introductory cryptography texts and tutorial papers. How nice. Other cryptographers had thought of the same scheme. Unfortunately, the scheme was presented as a simple homework assignment on how to use elementary cryptanalytic techniques to trivially crack it. So much for my brilliant scheme.

From this humbling experience I learned how easy it is to fall into a false sense of security when devising an encryption algorithm. Most people don’t realize how fiendishly difficult it is to devise an encryption algorithm that can withstand a prolonged and determined attack by a resourceful opponent.

So, if you're just interested in protecting your material against a causal reader it'll probably work. If you want to keep out people determined to figure out what you've written, you'd better try something else.