31

How can one generate a password that is easy to type but does not sacrifice security? An example of a password that is easy to type but sacrifices security (I imagine) would be qwe123!@#.

For this question, we'll use a pretty lax but standard password policy. Let's say:

  • 8+ characters
  • At least 1 capital letter
  • At least one number
  • At least 1 symbol

I am hoping this will take a little bit of the "usability" aspect out of the old adage "Security at the cost of usability comes at the cost of security". I am aware that a password manager or something like that would be a more ideal solution but not everyone is willing to incorporate something like that.

** After reading all the answers and comments here. My original intent for "easy to type" was something along the lines of near each other on the keyboard or alternating hands with smooth transitions between, which is why I accepted the answer I did. That said, the other answers (and the accepted one) have made me realize that I have been thinking about this the wrong way.

  • 3
    This is a very difficult to answer question, as it is primarily opinion based. There is no metric for "easy to type". – Jesse K Aug 3 '17 at 19:19
  • 1
    @JesseKeilson I agree and I've been thinking about whether or not to define it for this question and how I would. Ultimately I decided to refrain at the start in case someone knew of something but if nothing came up or it looked like it would be closed as opinion-based, I would include a metric. I didn't want to color any answers if I didn't have to. – Pants Aug 3 '17 at 19:25
  • 4
    Use a password manager :P It looks like you know to use one yourself, but I'll add my own anecdote anyway: For years, I didn't use a password manager because I thought it would make things more difficult for me. I started using LastPass last year, and not only is it amazing having very long passwords for everything - it's actually far more convenient than the tricks I was using beforehand! – Kevin - Reinstate Monica Aug 3 '17 at 22:10
  • one step might be to switch to an alternative keyboard like dvorak – Justin Ohms Aug 3 '17 at 23:38
  • 4
    Do you literally mean "easy to type"? Or "easy to remember"? Easy to type would be "aaaaaaaa". Easy to remember might be "it looks like I picked the wrong week to quit sniffing glue". – Nick Gammon Aug 4 '17 at 7:15
13

Disclaimer: I'm interpreting "easy to type" in this question literally to mean consecutive characters or similar typing patterns, which is different from passwords that are "easy to remember". I point this out because none of the other answers appear to interpret the question this way.

How to generate easy to type passwords without sacrificing security?

Short answer: Don't bother.

The reason is it's not worth it unless you are an extremely slow typist. I just tried an experiment where I choose two passwords, both were easy to remember, and one is (seemingly) much easier to type than the other. In order to more easily measure the timing with my stopwatch, I typed both passwords 3 times and compared:

Option 1: (12 seconds to type it 3 times)

This password is easy to remember
This password is easy to remember
This password is easy to remember

Option 2: (10 seconds to type it 3 times)

1234qwerasdfzxcv7890yuiohjklnm,.
1234qwerasdfzxcv7890yuiohjklnm,.
1234qwerasdfzxcv7890yuiohjklnm,.

I actually tried it a few times and the time shown above was my last set of 3 for each. The first couple of times I messed up the "easy to type" password because I was going too fast and bumped other keys.

My conclusion: it's likely to be the case that if you choose any passphrase that is easy to remember, it won't be much slower to type than one that is seemingly more "easy to type". (My average was 3.3 seconds vs 4.0 seconds.) Add to this the slightly higher probability that an easy to type password could end up in a dictionary list, and I'd shy away from it.

  • 5
    +1 end up in a dictionary, or can easily be procedurally generated, or can easily be shoulder-surfed. – Mike Ounsworth Aug 4 '17 at 14:13
36

Mandatory "Use a Password Manager!". But you seem to already be aware of this. Moving on.


There are any number of tricks. In my experience, "easy to remember" and "easy to type" typically means "full English words"; my fingers/brain have a much easier time with words than they do with arbitrary sequences of characters. Two systems that come to mind are:

Diceware

Grab yourself a copy of the Diceware word lists [Article], [large_wordlist.txt] and roll some dice! This list of 65=7,776 unique words was carefully selected to be easy to remember. Wikipedia gives these examples as typical diceware passwords:

  • conjoined sterling securely chitchat spinout pelvis
  • rice immorally worrisome shopping traverse recharger

Also: mandatory XKCD advocating passwords of this style.

Passphrase

I'm an advocate that we should ditch "password" from the English language - since it encourages people to think in terms of single words - and with the exception of a few especially moronic banks, all systems accept spaces in passwords now, so why not think in terms of "passphrases"?

A clever trick that I heard of is to set a passphrase that represents some personal-life goal you want to achieve or fact you want to remember. A) since you type your passphrase many times a day, it's a natural reminder to do the thing, and B) once you accomplish the thing, you have a natural reason to change your passphrase! The following would be examples that would naturally want to change after a month or so:

  • "update $% on my 401(k)"
  • "get under 10 Smokes/day"
  • "Sandy's baby due on Aug 24th"
  • "plan Grampa's 80th b-day party"

[ps. I'm waiting for the flame war on this suggestion. My generic answer: use a longer passphrase!]

  • 3
    I'm not sure that "easy to type" can be swapped for "easy to remember" and stay with the intent of the question. I thought "easy to type" was meant to be taken literally, as in consecutive letters on a keyboard, or similar. – TTT Aug 3 '17 at 22:25
  • 4
    I agree with changing the general concept of "password" to "passphrase" yet I am appalled at how many websites don't allow spaces in their passwords. :) – TTT Aug 3 '17 at 22:25
  • 11
    @TTT any number or symbol can be used instead of spaces if necessary. Low max character limits are a bigger concern IMHO. – ChrisD Aug 3 '17 at 22:46
  • 7
    @TTT I think ease to type is in the, ummm, fingers of the ummm, typist. As a long time touch typist, easy to remember usually means long strings of words with spaces, capitalization, and punctuation. That's very easy for me to type since I just use the same typing patterns I'm using to write this comment. The asker's example of "qwe123!@#" is much harder for me to type than "Sandy's baby due on Aug 24th". – Todd Wilcox Aug 4 '17 at 2:05
  • 2
    @ChrisD - hehe, of course. In the spirit of the question I was referring to the speed of typing the passphrase. "This is my password" is so much faster to type than "This_is_my_password". Even just skipping the spaces is slower because it's unnatural. – TTT Aug 4 '17 at 2:47
8

Everyday I have to type my password like hundred of times. So I designed a password which was "Easy to type", following these suggestions (based in my own experience):

1) Better if I don't have to use the "pinky" fingers (they get tired after a long use). I suggest avoiding any character or symbol on the extreme left or extreme right of the keyboard. Because of that, no so many uppercase letters should be used (you need to use your pinky for the shift key, right?).

2) Upper case letters should be able to be typed with your right hand (if you are right-handed) or with the index and middle finger of your left hand. The reason is that its easy (for me) to use the left shift than the right (because is farther from the center). Try this: Shift+q seems to add pressure to your hand, compared with Shift(left hand)+P(right hand).

3) If you can type your password with a single hand is better. Sometimes I have one of my hands busy, and typing Shift+7 with a single hand may not be so comfortable. I would say that if you are going to use uppercase letters, try to keep those close to the shift key.

4) Adjacent letters are easy to type (for example: hj in an QWERTY keyboard) but are usually easier to make a mistake (jh instead of hj). My suggestion here is to try not to use adjacent characters in the middle or end of the password to avoid mistakes.

5) Flow is also important. I have found that is easy to type something when all letters/numbers/symbols are moving from one side to another (like playing the piano). If you start in the left side and you finish on the right of the keyboard (or vice-versa). It may be easier also to type with a single hand. For example: 9641 vs 9164 (using the right hand)

6) If you alternate hands while typing is easier (IMHO). For example: "jspenro" vs "jkustwp". Try to keep up to 2 characters per hand. Most of the English words are like that (hands alternate naturally).

7) Not so important, but if you are able to type it without looking it a plus. One of my passwords I don't even know it, but I can type it really fast (as I'm not repeating it in my head), I just let my hands to do it for me: Procedural Memory

The above points works for me, but they may not work for others. If you are looking for an-easy-to-type password for yourself try my suggestions. Otherwise, stick to what has been suggested already: use a Password Manager.

  • 1
    While many of the other answers offer good suggestions regarding security, I think this hits on the the more important points that regardless of strength, passwords need to be physically easy to type. Awkward passwords can be a real pain when you have to enter them 20 or 30 times a day. – Christopher Hunter Apr 9 '18 at 17:06
  • 1
    Comment to #5. See this list of 7-char-long English words: phrogz.net/seven-letter-alternating-handed-words – Slawa Sep 18 '18 at 13:34
7

Dictionary passwords are the way to go. Wikipedia suggests that making a strategy predictable may not be the best route, but in this case it is.

From Wikipedia Information Theory/Entropy:

For instance, the entropy of a coin toss is 1 shannon, whereas of m tosses it is m shannons. Generally, you need log2(n) bits to represent a variable that can take one of n values if n is a power of 2. If these values are equally probable, the entropy (in shannons) is equal to the number of bits. Equality between number of bits and shannons holds only while all outcomes are equally probable

So if everything is equally probable, I'm as likely to put 'a' or '2' or '<' for a value, then options and length are all that matter. That considered, there are far more words than letters+digits+symbols in any language. Enough so that a 4 word password easily trumps a 10 character one.

To show how much of a difference:

26 letters in alphabet, 10 digits, maybe 15 symbols = ~50 options. 10 character password = 9.76 x10^16 options. If our computer's guessing 4 million a second, a rough, generous guess, we're at about 775 years to guess the password. Pretty secure. And, we can remember comfortably about 7 characters, 10 is doable, especially through password-style repetition.

This is with 10 characters, all equally weighted in probability, which is reasonable since it's likely to be gibberish that we'll have to right on the back of our hand to remember initially.

From that:

1) Length of the password is important in this case. Every character increases safety considerably. A longer password is always better. If for example we chopped our password down to 7 characters then we're at a meager max time of 2.25 days to crack with 50 options for each character.

2) But say if I make a password as the XKCD comic describes, nothing is stopping anyone from throwing a dictionary at a password like "remember elephant lost woods". Say if I use john the ripper, which has ~3000, with an option to make each plural or to chop off an s if it ends with one, then maybe ~6000 words. If there are 4 words in my password then 6000^4 possibilities = 1.3 x10^15, 10 years

Pretty secure. And, John the Ripper wouldn't actually crack the password:

correct horse battery staple

John the ripper is using common passwords. So common that only 'horse' actually shows up in there. Say if I use uncommon enough words that cracker dictionaries don't anticipate, then the last option is a legitimate dictionary-attack.

If I use fedora's default dictionary, with a very-comprehensive 500 000 words, for a 4-word password there are 6.25 x10^22 possibilities we're at about .5 billion years cracking time. But it's not farfetched to say that this could be cut down to at most 25% of its size, especially if common words like 'correct horse battery staple' are being used. So, 125 thousand possibilities. Still, 2.44 x10^20, which is about 2 million years.

What if we could cut it down to %1? So 5000 words. That's 6.25 x10^14 possibilities, nearly the same number as with the john the ripper attack, about 5 years max. Is it really feasable to cut it down to 1%? Probably not if the most common words aren't used.

But this also depends on whitespace delimiters. If I have

azkaban_P0tter*flubber st@ple Then we've destroyed the first equality of bits in the shannons conversation, but added an insurmountable amount of variables even if the attacker completely anticipates this tactic.

Also, if a smaller dictionary of say 200 000 could be used, reducing that to 1% is still maximum 45 days, and avoiding the most common words and using varying word delimiters would increase this duration drastically, and throwing in a word or two in another language if that's easy.

  • 1
    I have done some research in this space...are you sure that your assertion of a 5 million word dictionary is accurate? Admittedly my research was constrained to English (both American and British) and 4-9 letter words, but even including the most obscure words I was well below 200k words. EDIT: a quick search reveals there are 171,476 words in the 20-volume Oxford English Dictionary. – R15 Aug 3 '17 at 21:52
  • You're right, that was a mistake, the fedora dictionary is 500 000 words. I will fix my math – flerb Aug 3 '17 at 21:56
  • Even 500k seems high - what does it cover/include? – R15 Aug 3 '17 at 21:57
  • rpmfind.net/linux/rpm2html/… – flerb Aug 3 '17 at 22:10
  • Sorry to just send the poorly-formatted link, was editing. It does seem like possibly an excessively-comprehensive dictionary, but I thought it would amount for minor variations of words. It for example includes portal-to-portal and capitalized versions of many words. Are you suggesting that the dictionary size would be significanly smaller for this type of attack? – flerb Aug 3 '17 at 22:30
3

Have a look at this post I think it's very much related to what you've asked here:

XKCD #936: Short complex password, or long dictionary passphrase?

Also, that's a very theoretical question, I mean each one find different things harder to type i guess "qwe123" is indeed "easy to type" but some will argue that their names/things they like are "easy to type" passwords as well. Also you can interpret "easy to type" to "easy to remember" is that what you mean(?)

In my opinion an easy to type password without sacrificing security is first of all a long one, and than something that only you can think of (and if you use the methods that you mention inside that would increase the security of the password of course).

0

I was going through the same thought in my mind and I came up with asdff3F#, asdffF3#, asdff9F(, asdffF9(, etc.

I considered the following:

  1. We place left hand fingers on asdf, using the same characters for alphabets will help us in no displacement of left hand.
  2. Using right little finger to click shift.
  3. Displacement is minimum if we move middle finger of either hand (I can reach 3 with left middle finger and 9 on right middle finger).
  • While this might be easy to type, it is an example of what the OP identifies as "sacrificing security". These are not good passwords. – schroeder Dec 26 '18 at 13:13
-1

An easy option would be concatenating Words as in: hellohereiam0x45 We gained a 16 Letter length password. Which will be resistant against simple brute forcing. You can even strengthen it like:

HelloHereIAm0x45

I simply capitalized every word to gain addition strength, without loss of memorization. Additionally you could abstract it even more like switching O with 0 etc.

H3ll0H3r31Am0x45
  • 2
    This does not add anything so the points mentioned in the other answers – Jan Doggen Aug 4 '17 at 15:21
  • "switching O with 0" - 1337 password simply do not increase security in any way. It is just a matter of running a regex on a dictionary file and re-attempt. Many dictionary databases ( jack the ripper ) already have 1337 words inbuilt. – grochmal Aug 5 '17 at 14:08
  • @grochmal it's simply about the length and abstract words. Sure it's not secure if you use <8 Char passwords. – 0x45 Aug 5 '17 at 16:24
  • @grochmal while your point is true that it may not increase security, many password policies nevertheless require use of X numbers in the password. Assuming the password is otherwise sufficiently complex, 1337 substitutions can be useful to construct passwords that are still easy to remember. – Christopher Hunter Apr 9 '18 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.