Especially in cryptocurrencies you often hear people say that private key/seeds should not be typed "randomly" by humans, but rather use a truly random number generator. I understand, that humans behave in a certain way, so there must be patterns that would shrink the search space of a brute-force attack significantly.

That's the theory. But in practice, how would someone model such an attack? I know there are researched cognitive biases in perception and production of randomness but are there models, how you would model a search space of a human "randomly" hitting a keyboard?

  • 2
    you could run a mechanical turk asking for 50 key presses. – dandavis Jan 12 '18 at 7:07
  • Type something randomly on your computer for a very long time, now count the occurences of asdf qwer zxc, ... It's a bug in humans, they often confuse typing fast with typing random, or think speed somehow increases randomness. :-) – Nomad Apr 12 '18 at 16:00

A simple answer is that a human will tend to hit keys in the middle and/or on the 'home row' of the keyboard more and will tend to hit keys near each other together more often (due to double hits). There may also be more 'non-shifted' special characters and number row characters. Numbers and Special characters can capitals are more likely to be grouped (or just appended to) the main 'random' string.

You will therefore get a higher frequency of asdfghjkltyuivbnm, sequences like sw qd l; etc. and more in the format of oipynKJIU8767@~{&$

These can be consciously avoided, but this could from its own patten or have a too even mix (nearly the same number of each type).: dR%6Ni9)lI&6...

This could weaken things somewhat and give the attacker some assistance, but for a long string it's unlikely to be significant. It would also require the attacker knowing it was human generated to they a modified brute force attack

None of my suggestions on frequency is comprehensive and a bit of effort can produce a very random string.

Personally I often use a password generator then change a couple of items or to remove any link to the pseudo-random seed (a bit paranoid really).

| improve this answer | |
  • 1
    Another pattern you missed is that humans almost never generate repeats. Doubled characters will occur about once every 26 random alphabetics, but a human randomly typing letters will probably never generate a sequence such as "mm" or "ss" (and never something like "wwww"). – Mark Mar 13 '18 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.