This question is inspired by this one: How long should 2 factor authentication codes be?

Basically, there is a practical lower and upper bound of 2FA code length. It can't be too short such that an attacker with all passwords could bruteforce a significant percent of accounts. But it also can't be too long such that it's difficult to commit to short-term memory.

So then why not use a dictionary/diceware phrase? Something like puppy banana galapagos moose is just as easy to remember as 327229, but offers much more entropy.

The only disadvantage might be that it is more time-consuming to type, but with mobile keyboards with autocomplete, it would only take an extra second or two while drastically decreasing the percent of accounts that could be bruteforced.

  • Interesting, I thought the exact same thing when I read the other question – Joe Aug 21 '17 at 21:01
  • 9
    why would you need to remember one-time codes? – Eugene Mayevski 'Callback Aug 21 '17 at 21:33
  • 1
    Agree no need to memorize, more letters just makes it harder to use. Logging into a computer with the phone as 2FA: prop the phone up on the monitor and refer to it as you type. Logging into the phone itself: copy-paste or use split-screen features. – Ben Aug 21 '17 at 23:06
  • 1
    Companies may also be reluctant to use words, partly because it may appear less secure to non-savvy users, and partly because it may create some string that is unintentionally offensive or otherwise reflects poorly on the company. – IllusiveBrian Aug 22 '17 at 0:53
  • 6
    Easy for you. English is not my mother's tongue, I had to look up "moose" in a dictionary. It's also easy for many people to misspell pupy or bannana. (It's also longer to type.) – A. Hersean Aug 22 '17 at 12:41

Yes you are increasing entropy but you are decreasing usability.

Firstly you need to get a good dictionary. Things you need to think about are accessibility (how readable is it? Are there b,d or q,p or cl,d or I,l confusions? You can't have click and dick in the dictionary) Are the words easy to spell from memory? I can't spell 2/4 of the words you used and I have a BSc. You can't have any that are too technical or culturally insensitive (e.g. Taiwan )

Secondly you say about mobile keyboard with autocorrect. Autocorrect goes wrong, you need to check every word in your dictionary will be in them for a long time (if bananas go extinct tomorrow will the word still be in an autocorrect in 30 years?) and you are making it harder for those with full size hard keyboards

Thirdly you are cutting out everyone who doesn't speak the language, numbers work across all languages. There are very few other number systems used outside the 123 numbers.

Fourth how are you going to display them? A 6 digit number can be on a 6 digit 7 segment display, 4 words need at lest a 20 digit complex display or better. "But they can be on a phone" I hear you say, but there are places you can't have a phone because there are no wireless devices allowed (its hell on earth, never work in a place like this) and that would fragment the market to those with mobile devices and those without which leads into

Lastly it would fragment the market. For tech like this fragmentation is bad, we trust it because it has been tested lots and lots. Unless the old thing is broken or the new thing is 1,000,000% better than the original it will never take route. As it is we still have broken encryption methods now because they might brake something worse if removed and banks that still use something you know and something you know (2 passwords)

The improvement they could make to 2fa devices is to be able to set how long the code is on the screen upto 60 seconds max (10 seconds per number for accessibility reasons) and have the box you type it into tagged as a number box so that soft keyboards show either the number row or better a number pad.


To add to @topher-brink awnser.

2fa are used in more situations than human - machine communications. there are implementations of using a 2fa in some hardware devices (they use something like he u2f dongles).

These devices can not work with strings of characters (and in what encoding scheme they might be) but for numbers there are no such problems.

As a usecase for such a system think of a medical device that needs to communicate with a service but also ensure intent and confidentiality. (so it uses a Client-side certificate and a 2fa mechanism) The device can present the client with an accept decline dialog but not with a number or textual string for its 2fa.

  • I had never thought of or come across a computer to computer implementation of 2fa. The only query is , is it real 2fa? If I store the password and the 2fa key on the computer they both are something the computer knows. Is the 2fa crated with a separate bit of hardware like a secure enclave? – Topher Brink Aug 23 '17 at 8:26
  • yes, the 2fa is a dedicated piece of hardware (or it would not be a 2nd factor ;) ) there are also cases where you find they use a smart-card with private/public key encription and TOTP or HOTP extentions on the card. – LvB Aug 24 '17 at 8:16

This answer has already stated the usability concerns with your scheme.

Another problem that is worth mentioning, is the implementation. Most current OTP schemes are using the HOPT/TOTP algorithms specified by the IETF. Those are very easy to implement and only take up little codespace making them suitable for small embedded devices (like OTP tokens). If you want to translate the calculated numeric password to a list of words, the code would need to include a long (probably 2 digit kilobytes in size) list of predefined words. Apart from making things more complicated, that could proof a show stopper for constrained devices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy