In Teamviewer, I am using "secure (8 characters)" passwords that are changed daily. I noticed that the password is always 4 numbers and 4 lower case letters, with random positions.

I might be naive, but isn't that less secure, because it reduces the amount of possible alphanumeric combinations? Or is it more secure because there'll never be an 8 digit password that is letter only or number only? My intuition says no, but then why would Teamviewer do this...

  • 4
    @MaxVollmer any predictability means its not true randomness, meaning yes it is less secure than if we assumed it was a random string of alphanumeric. – TheHidden Feb 6 '18 at 9:32
  • 1
    As for "why" one possible reason is that 4 lowercase letters and 4 numbers are easier to remember and to tell someone else than even 8 lowercase letters. It's likely purely a UX thing. Microsoft does the same thing for their automatically generated passwords on Live.com: abcd1234 – schroeder Feb 6 '18 at 11:01
  • Max, I did a math mistake in my answer. I have now fixed it, and the conclusion is quite different. – Anders Feb 6 '18 at 15:45

Warning: A previous version of this answer contained a big math error leading to incorrect conclusions. It has now been fixed.

Let's calculate some entropy!

  • A random password consisting of 8 lower case letters or digits:

    log2((26 + 10)^8) = 41.4 bits
  • A random password, where exactly 4 characters are lower case letters and exactly 4 are digits:

    log2(26^4 * 10^4 * (8 choose 4)) = 38.2 bits
  • A random password, containing exactly 8 lower case letters:

    log2(26^8) = 37.6 bits

So, what conclusions can we draw from this?

  • As you can see, we lose some entropy - almost 3 bits. This means the password would be about 7 times faster to crack.
  • To do this to avoid passwords with only lowercase is a bit misguided, since now all passwords are almost as bad as lowercase only passwords.
  • The best guess is probably that this is a UX decision. The mix makes them easier to remember and read aloud. The loss of entropy (less than the equivalent of removing one character) could be deemed "worth it".
  • 1
    Heh, "letters AND numbers" sounds a lot more secure than just all lowercase letters. – schroeder Feb 6 '18 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.