Song Lyrics as passphrases [duplicate]

Question

I have a question slightly similar to this question. I am familiar with the correct horse battery staple example from xkcd, yet I am leaning towards songlyrics as a passphrase, since I have a brain that remembers songlyrics very easily.

Now, I am wondering how long a passphrase made up of songlyrics should be at least, to provide "acceptable" security level comparable to the 44 Bits of correct horse battery staple. The tricky part is the social-engineering part of the question. If I google the lyrics beforehand, like one answer mentioned here, I know I am not covering up my trails. But, like I mentioned before, I know many song lyrics by heart and do not need to look them up before setteling for a passphrase. Would that do me good?

In essence, my question is asked with the assumption that a hacker social-engineered my fondness of pass-lyrics. In case that is a known fact for an attacker, how long should pass-lyrics be and would it also be a self-inflicted wound to use song-lyrics including numbers? I guess the latter part will definitely make it easier, for social-engineered attacks, yet harder for brute force.

I am well aware of the vagueness of my question, but all I am looking for is a basic rule of thumb. Right now, I am using pass-lyrics for rather low-risk accounts, but I am trying to think of something and the correct horse battery staple is not ideal for my stupid-ass brain.

Eidt: I do not think it to be a duplicate of that BBC question in question, since I am considering whole lines of lyrics instead of first letters and as one asewer pointed out, 7 letters cover 65% of the language with the first letters of words.

Answer 1

As with any password guessability/strength question, likely the most important factor is "who's the attacker".

For online password guessing attacks, by an attacker who doesn't know you, the most important factor is ensuring that your password won't be guessed before the account lockout kicks in. For that as long as your password isn't in the top couple of hundred likely picks, you are likely to be ok. Lyrics (especially ones from a song that isn't currently that popular) are very unlikely to be guessed here.

If you think about a scenario where a website you have an account on has been compromised and the password database is being cracked, well your account on that system is likely burned, so in terms of stopping the security of your other accounts being affected the most important factor is ensuring that you use unique passwords on each site you make use of. If you can do that with song lyrics, you won't be affected by the compromise of one password.

If your looking at a scenario where the attacker knows you, things get more risky, especially if you've disclosed the scheme you're using. It would be relatively easy to create a database of popular song lyrics and apply that to an offline password. But what you've got to consider is, is anyone who knows you likely to do that... That's a risk decision only you can make.

Some practical considerations with this scheme. You may well have problems using it on sites which enforce password classes (e.g. special characters). You may also have problems with sites which enforce arbtrary upper limits on password length.

Answer 2

Sorry, but you're not the first person to think of this so you can bet that this technique will be automated in some password cracking software. It's always best to assume that the hacker knows your generation scheme when evaluating these sorts of schemes.

So how secure is this? Well a quick googling of "number of songs on spotify" threw up the number 30 million. Doing a word count on a random song (https://genius.com/Tim-minchin-3-minute-song-lyrics) threw up 483 is about the number of words in a song. For a four word password you can guess like this: "the wheels of the", "wheels of the bus", "of the bus go" and so on (this is not the smartest way to guess, you could put your phrases in a hash set first to remove duplicates).

Notice that using more words doesn't really increase the entropy that much. There are 483 words in a song, there are 482 2-word phrases, 483 3-word phrases and so on.

So, 30 million * 500 = 15 billion or 33 bits of entropy or 2048 times less secure than a password form of actually random words. This is a large over estimate of the security because of the hash-set optimisation.

Answer 3

Any form of password manager would solve you this issue. Currently, you are trying to overcomplicate passwords. Song lyrics is definitely an interesting idea for a password, and the length alone is relatively secure, but if you want to have something secure that you can remember, and wouldn't cause issue use a password manager.

Answer 4

It strongly depends on how well the social engineering is done.

If the attacker only knew you are using song lyrics and there were a million songs to randomly choose the lyrics from, it would be secure enough for low risk accounts.

BUT you don't choose the songs randomly. I assume that most of the songs you listen to are from a relatively small range of genres and bands. If the attacker has detailed knowledge about your preferred music, the number of songs will be reduced to a few hundred and your strategy will become very insecure.

Getting that information can be really easy: One could ask your friends about your taste concerning music, if he doesn't know you yourself. If you are sharing the music you listen to using facebook and spotify or lastfm it gets even easier.

The length of the fragment won't play a big role anymore, since the order of the words is defined by the songs. In fact, if you are only using full sentences or lines this will reduce security even more.

Assuming you are using full lines of a selection of 100 songs, each of which contains 20 different lines (The refrain lines count only once), you will end up with as little as 2000 different passwords.

That are less possible passwords than when using 2 random latin letters (uppercase and lowercase allowed), like "yA" or "UD".

To sum it up, it is a bad idea to use songtexts as passwords.

Answer 5

As you are using passphrases of several words, your password is large enough to be immune to simple brute force attacks. But the weakness here is that you are not using 4 random words from a song but I think that you will use a true sentence with a meaning by itself in song order. If we limit an automatid scheme to sentences from 4 to 8 words (*), we get per song not more than 5 * number of words. Not much more than several thousands for a common song. As I am thinking of an automatic dictionary like attack, I am not considering the meaning here. But I'm afraid there are not enough songs around to make that password method resistant to a targetted attack.

In that sense, this answer is not much different from the BBC one: the best pattern to build a password is to use no pattern. That's the reason why password managers have nice reputation here, they allow the use of true random passwords which by construction are resistant to any attacks... except for the rubber hose series that here would include local attacks against the password manager, if the master password is weak...

---

(*) Less than 4 will lead to really short passphrases, and more than eight will soon be tedious to manually type.

Answer 6

One thing that matters quite a bit is what song you pick. Supposing there is any kind of automation scheme going on, they are going to attempt to use lyrics from top 40 kinds of songs first before delving into more obscure lyrics. Again, this is where someone attacking you personally could change things: if they know your music choices, they can take that angle and narrow their song selection.

You could do some kind of basic transformation to song lyrics, like taking the second letter of each word in a long phrase or changing certain letters to numbers. That would reduce your risk for someone targeting you considerably.

Answer 7

I would suggest instead to use sentences including punctuation, and then use only the (capitalized) letters of that sentence. Add numbers if you like. The problem with words is that they can be found in a dictionary, which will make your password much less secure than you would think.

Remembering sentences is actually fairly easy. This system has led to me having >10 long passwords with mixed punctuation and non-word characters as a minimum, up to 15-20 when important. That is a good bit more secure, and still fairly easy to remember.

You probably could use this with your lyrics if you want.