# Would a password saved on paper written in a personal writing system be decipherable?

A while ago I created a small writing system to write personal notes, it was more an experiment to see if I could make one and then memorize it.

Seeing as nobody else knows how it works, I created a random password of about 20 characters, and wrote this down on a piece of paper, then I sent a picture of that piece of paper to a close friend of whom I am sure doesn't ever lose her photos. I also saved one in Google Photos.

I don't trust password managers since KeePass which is (at least used to be) recommended a lot is crack-able.

Would it be possible for anyone to crack that?

I hope this isn't an incredibly dumb question, I personally can't come up with any way it would be possible to crack this, but I want to be sure.

• Unless you are a cryptographer who has studied and has decades of experience in the field, chances are deciphering your home-made code would be a walk in the park for seasoned cryptographers. And if you're actually qualified to devise your own ciphers, you wouldn't be asking this question. This kind of question has been asked so many times in many different ways, I just hope that I can keep myself together and not fall like the regex guy next time this shows up again. – Lie Ryan Jun 3 '17 at 19:48
• Is it a simple substitution cipher? – Andrea Lazzarotto Jun 3 '17 at 22:23
• I don't understand why you write down your password, take a photo and then send that photo around? I thought the whole Idea was to avoid digitalization? KeePass would be far more secure than this approach. In fact if you write down your password in plain text and the just don't show that to others then that approach would be more secure already – BlueWizard Jun 3 '17 at 22:33
• I make two assumptions: first, that your writing system is a not an obvious (ie, easily guessable) transformation of the alphabet, and second that this image is the only thing the Eve has to work with. In that case, Eve has only the clues inherent in your system - for example, they might hypothesize that characters in your writing system correspond to characters in English, so they know how long your password is. But beyond that sort of obvious stuff they would have very little to work with. – Jon Kiparsky Jun 4 '17 at 0:44
• What do you mean in your statement that KeePass is crackable? I haven't heard anything about it lately. I would like to know since I am using it now. – Kodos Johnson Jun 4 '17 at 5:08

I hope this isn't an incredibly dumb question, I personally can't come up with any way it would be possible to crack this, but I want to be sure.

Being unable to come up with a way to crack your own invention isn't generally seen as an indicator for quality in security circles.

Would it be possible for anyone to crack that?

That depends very much on how your personal writing system works, and how much additional text in this writing system is available to an attacker.

Your question is basically a cryptography question: You have a script no one except you knows, and you want to know whether it's decipherable. There are some historic parallels; for example, Linear A is an ancient writing system that remains mostly a mystery. And if you visit the British Museum, you'll see the Rosetta stone, without which we might not be able to read Egyptian hieroglyphs today.

Assuming your writing system simply replaces letters, or maybe syllables, with your own symbols, it should be fairly easy to crack given a few pages of text written in it. A simple frequency analysis would probably be enough to crack it.

However, if the only thing your attacker has is the picture of your password in your writing system, and the password is random (e.g. not a known word), then I'd say chances of successful cracking are slim. This is because unknown writing systems and ciphers are often cracked because the people working on it make correct guesses about context, and if there is no context, this doesn't work.

What could be problematic is that because a good writing system is designed to be useful, you might have made an 'e' simpler to write than, say, a 'q'. So it might be possible to make some guesses as to which symbol corresponds to which actual letter, which would reduce the number of password guesses an attacker might need to make (e.g. if he correctly assumed that the fourth letter was an 'e' and the seventh was a 't', maybe based on the shape of your symbols, he'd reduce the time needed to find the correct password by brute force (trying every possible combination of characters) by about three orders of magnitude.

• Thank you very much for that extremely useful answer. Using what you've said, I have made a new writing system which I will only use for randomized passwords. I had written down a lot of random "letters" and randomly assigned them to letters, numbers and other symbols, so I hope that's enough security to allow me to hang post-its next to my screen :) – user149981 Jun 3 '17 at 17:10
• Glad to help. Note that even even an "uncrackable" script will likely leak information about the password. For example, if a symbol appears twice, an attacker can assume that the password contains the same letter/digit at these positions. And assuming you're using simple monoalphabetic instead of homophonic substitution (google it), different symbols will correspond to different characters in the password. This won't uncover the correct password, but again it will cut down on the time needed to try candidate passwords, because lots of passwords can be excluded due to these known patterns. – Pascal Jun 3 '17 at 19:05
• @WeiShen you are describing a substitution cipher where one symbol maps to one letter. Theese are insecure and can be cracked since * looks on watch * a few hundret years ago. – BlueWizard Jun 4 '17 at 22:01
• @BlueWizard - you're missing the actual context of the question. In the context of the question asked, encrypting only a single random string of characters, this is pretty much impossible to crack - as long as the substitution isn't somehow obvious, or otherwise recoverable. – Pascal Jun 5 '17 at 7:16
• @Pascal so you mean it's incrackable as long as it has the same properties as a one time pad? OP probably will not re-invent the cipher everytime they transmit a password. And if OP does than OP got to write down (or remember, which is unlikely) the cipher – BlueWizard Jun 5 '17 at 8:05

Of course it's possible for someone to crack it. As Pascal notes above "Being unable to come up with a way to crack your own invention isn't generally seen as an indicator for quality in security circles."

This quote from Phil Zimmerman's book "Introduction to Cryptography" is a great example:

When I was in college in the early 70s, I devised what I believed was a brilliant encryption scheme. A simple pseudorandom number stream was added to the plaintext stream to create ciphertext. This would seemingly thwart any frequency analysis of the ciphertext, and would be uncrackable even to the most resourceful government intelligence agencies. I felt so smug about my achievement.

Years later, I discovered this same scheme in several introductory cryptography texts and tutorial papers. How nice. Other cryptographers had thought of the same scheme. Unfortunately, the scheme was presented as a simple homework assignment on how to use elementary cryptanalytic techniques to trivially crack it. So much for my brilliant scheme.

From this humbling experience I learned how easy it is to fall into a false sense of security when devising an encryption algorithm. Most people don’t realize how fiendishly difficult it is to devise an encryption algorithm that can withstand a prolonged and determined attack by a resourceful opponent.

So, if you're just interested in protecting your material against a causal reader it'll probably work. If you want to keep out people determined to figure out what you've written, you'd better try something else.

• Thank you for that interesting quote, it's kind of funny how someone who created an algorithm that turned out to be a homework assignment went on to make PGP. – user149981 Jun 3 '17 at 17:17