1

In Teamviewer, I am using "secure (8 characters)" passwords that are changed daily. I noticed that the password is always 4 numbers and 4 lower case letters, with random positions.

I might be naive, but isn't that less secure, because it reduces the amount of possible alphanumeric combinations? Or is it more secure because there'll never be an 8 digit password that is letter only or number only? My intuition says no, but then why would Teamviewer do this...

3
  • 4
    @MaxVollmer any predictability means its not true randomness, meaning yes it is less secure than if we assumed it was a random string of alphanumeric.
    – TheHidden
    Feb 6, 2018 at 9:32
  • 1
    As for "why" one possible reason is that 4 lowercase letters and 4 numbers are easier to remember and to tell someone else than even 8 lowercase letters. It's likely purely a UX thing. Microsoft does the same thing for their automatically generated passwords on Live.com: abcd1234
    – schroeder
    Feb 6, 2018 at 11:01
  • Max, I did a math mistake in my answer. I have now fixed it, and the conclusion is quite different.
    – Anders
    Feb 6, 2018 at 15:45

1 Answer 1

4

Warning: A previous version of this answer contained a big math error leading to incorrect conclusions. It has now been fixed.

Let's calculate some entropy!

  • A random password consisting of 8 lower case letters or digits:

    log2((26 + 10)^8) = 41.4 bits
    
  • A random password, where exactly 4 characters are lower case letters and exactly 4 are digits:

    log2(26^4 * 10^4 * (8 choose 4)) = 38.2 bits
    
  • A random password, containing exactly 8 lower case letters:

    log2(26^8) = 37.6 bits
    

So, what conclusions can we draw from this?

  • As you can see, we lose some entropy - almost 3 bits. This means the password would be about 7 times faster to crack.
  • To do this to avoid passwords with only lowercase is a bit misguided, since now all passwords are almost as bad as lowercase only passwords.
  • The best guess is probably that this is a UX decision. The mix makes them easier to remember and read aloud. The loss of entropy (less than the equivalent of removing one character) could be deemed "worth it".
1
  • 1
    Heh, "letters AND numbers" sounds a lot more secure than just all lowercase letters.
    – schroeder
    Feb 6, 2018 at 10:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .