3

I want to make sure my password is very difficult to bruteforce but also easy to remember and convenient.

So my idea is to just use a short password and repeat it a few times like this:

Password654321Password654321Password654321Password654321Password654321

How much less secure is this compared to using a password that is totally random, all else being equal (same length, same letters, numbers used)? For example:

aP2wd1odsaaP42r.....3dr

Or are both options equally hard to bruteforce?

Also assume that the password is not part of a dictionary.

|improve this question
  • 1
    Theoretically, the only factor in password strength is entropy. If you have a predictable pattern like that, it will never be as strong as an equally long random pattern. If something makes it easier to remember, it's probably less random. However, you're probably a minority that does this, so an attacker might not try it. I don't have data on how common this is, though... – Luc Dec 25 '18 at 12:06
  • 1
    Entropy is the opposite of order. If you have clear order, you have no entropy. So I'd say merely repeating the password a few time adds nothing to the result entropy – BlueWizard Dec 26 '18 at 9:15
3

How much less secure is this compared to using a password that is totally random?

Or are both options equally hard to bruteforce?

These questions are a little meaningless without a security context. The Electronic Frontier Foundation has an excellent guide called "Assessing Your Risks". Points 2, 4 and 5 from their checklist seem the most relevant here:

  1. What do I want to protect?

  2. Who do I want to protect it from?

  3. How bad are the consequences if I fail?

  4. How likely is it that I will need to protect it?

  5. How much trouble am I willing to go through to try to prevent potential consequences?

The password scheme you present is only good until the attacker figures out your pattern and builds a wordlist based on that pattern.

Who do you want to protect it from?

Your pattern will be very obvious to anyone who hears you type it. So if your threat model includes family members, co-workers, someone who can place a microphone in your room get access to your cell phone, then it's adding almost no value.

How likely is it that I will need to protect it?

If you're using this pattern across all websites, then it's only a matter of time before your passwords start showing up on haveibeenpwned.com.

Are you enough of a target that cyber criminals will spend time studying you? Do you have a close friend or family member who is a journalist with international enemies? For example, is your company a target for ransomware or military / industrial espionage? If yes, then someone studying you will find your old leaked passwords and figure out pretty quickly what your pattern is.

How much trouble am I willing to go through to try to prevent potential consequences?

The answer to this question will depend on how you answered the questions above.

If this password is protecting something that would be valuable to national / criminal security groups, then you should a proper strong password, not something based on a "trick". The EFF has a guide for creating strong passwords, and I suggest you read it.

Bottom Line: The password scheme you propose will probably keep you safe from random drive-by password guessing, but for the same effort you might as well do something stronger like DiceWare passwords or a password manager.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.