Which is better master KeePass password to prevent any type of bruteforce between theses two type of password :

  • Complete sentence invented by user like : I like cheeseburger, tomatoes and fries ! :)

  • Each first letter of the word with lower and higher case : Ilcb,tAf!:)

Edit : My hesitation come from the fact that the sentence indeed is longer but, it composed of real words which could be taken from a dictionary.

Short Answer :

Thanks to @Royce Williams, I can conclude that the best password generation method is random words with some char like :

shoes, tomatoes ! meal computer car

  • 1
    Always relevant: xkcd.com/936 Although a valid sentence may be easier to guess than random words. – multithr3at3d Dec 21 '19 at 14:09
  • "I like cheeseburger, tomatoes and fries" and "I love crustless bread, tacos and fruit" both would be stronger passwords than "Ilcb,Af". (Not simply because they're longer...) – Future Security Jan 4 at 18:19
  • Then you have to ask yourself, "Was cheeseburger 'c' or was it 'cb'?" "Did I capitalize the first letter?" "What other letters were capitalized?" and "Was there an Oxford comma?" And in my opinion you're better off using an extra word, compared to mangling a passphrase or password with arbitrary capitalization, 1337speak, punctuation mutations, or intentional misspellings. It's not inherently more or less secure (that depends on how large a pool you draw the extra word from) but it sure makes passwords easier to remember. – Future Security Jan 4 at 18:36

Neither - they are usually effectively equivalent.

This is because:

  1. password crackers are very aware of non-random, human-understandable passphrases - and can (and do) emulate both subtypes at high speed, and

  2. injecting memorable additional sequences like "!" and ":)" is just as well known and "simulatable", and

  3. the effective entropy of either kind of passphrase-based construction technique once the methodology is known to the attacker are virtually identical.

It's #3 that is the most important lesson here, and why raw bruteforce is irrelevant: because the effective entropy of this method - how much work a real-world attacker has to perform - is dramatically less than the bruteforce entropy. This is because the psychology of naive password-memorization strategies is well-known to the attacker.

In your specific methodology, you only have to remember about eight things to remember the password:

  • the fact that you're using a passphrase at all (this is a freebie for the attacker, because they will be attacking passphrases as a class)
  • the rough meaning components of the original phrase (liking, food, and which two foods, perhaps roughly four pieces of information) (since the phrase makes grammatical sense, much of this is also easy for the attacker)
  • the fact that you did or did not use whole words vs the first letters (since there are only a few options here, this isn't hard for the attacker to exhaust both variants)
  • the placement and location of the two additional items (attackers know that people tend to put the special-character "extra" stuff at the end)

If the attacker had no idea at all in the history of password psychology that anyone would ever do this, you'd be in pretty good shape. But attackers know very well how people think about passwords, and what they do to "chunk" them into "memorizable" components. (In other words, your methodology does not adhere to Kerkhoffs' Principle).

So an attacker only has to "bruteforce" the psychologically likely effective entropy of your password. The attacker doesn't have to bruteforce all possible characters of length X; instead, they can dramatically reduce the things they have to guess by only trying the same possibilities that make them easier for you to remember.

By contrast, the most effective passphrases are random passphrases: five or six words, drawn purely randomly from a wordlist of, say, 20,000 words or more (20,000^5, or 3.2x10^21). Even if the attacker knows everything that you do about the construction methodology - exactly how many words are in the list, and exactly how many words you selected, and how you separated them, etc. - the sheer volume of possibilities is resistant to bruteforce. You only have to memorize five words - but they are so many possibilities that trying them all would take a very, very long time. If you do the math of this, you'll quickly start to understand.

(And the concern about "using words in the dictionary" is a leftover from old password complexity requirements that were trying to prevent people from using single words from a dictionary. The underlying principle - avoiding "guessability" - is a good one, but it's totally OK to use a large number of random words that happen to be in the dictionary)

Any password system whose strength is based solely on a large amount of randomness will always be stronger than one that isn't.

| improve this answer | |
  • 2
    I sort of disagree with this answer, since it ignores how human beings actually behave and what they're good/bad at. Memorizing random things is HARD. People are just terrible at it, and honestly telling people to use 5 random words is just poor advice since nobody is really going to do that. That's why many people advocate a meaningless phrase, which is far better than using a word. Or better yet, use a password manager that generates random characters and protect it with some form of two-factor. – Steve Sether Jan 3 at 16:59
  • 1
    Passphrase advice is generally confined to specific use cases - passwords that must be memorized (such as for non-web interactive (Windows) login or for password managers), passwords that need to be human-legible or human-audible, etc. For everything else, long, random, and managed by your vault is of course awesome! IMO, five random words is quite manageable for memorization, well within the lower bound of human short-term memory capacity (making rehearsal for transfer into long-term easy). The XKCD method of making up a story to match has a long history of success in memorization training. – Royce Williams Jan 3 at 21:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.