It's a given that users will choose bad passwords. Why not help them out? Using a securely-random choice from a large dictionary, choose one or two words and tell the user to write them down. When they log in, require username, password, and the words that were generated. The password hash is based on the concatenation of the password and the secret words.

This provides a clear entropy boost from the perspective of a hash-cracking attacker, and prevents password reuse from being as much of a problem, too. Since the entropy comes from the random choice from a list, the server could normalize case and auto-correct spelling before hashing, to make it easier on the users.

I believe that writing down passwords is just fine in most cases, because people are generally good about protecting sensitive information that they write down. By instructing the user to write the secret words down, the burden of memorizing them is removed. They will still choose a password to meet very minimal complexity requirements (e.g. minimum 8 characters, 2 character sets, 4 unique characters), so it is likely they will not write down the entire access key (password + secret words).

This question is a similar idea, but instead of offering choices (which removes entropy, since users will choose things that "make sense"), words are provided directly. The words would look similar to the old AOL passwords distributed on their CD-ROMs.

EDIT: The context I imagine is a web site or other system with many distributed users. I'm not necessarily suggesting this for corporate login systems.

  • "I believe that writing down passwords is just fine in most cases" - youtu.be/_UqEg1cFqig
    – Sandokas
    Feb 26, 2014 at 15:48
  • @Sandokas Great film! Yes, users often write their passwords "under their keyboards" or otherwise publicly accessible. But they would do that anyway. Here, we could instruct them not to write both the password and the secret in the same place. Feb 26, 2014 at 15:51
  • I think the reason why you let users change their passwords is so they can actually change them if they feel they might be compromised without loosing access. How will you make sure user can change password anytime he feels his account might be compromised, making sure of identity by other means and without him having downtime access?
    – Sandokas
    Feb 26, 2014 at 15:57
  • @Sandokas Good point. Changing the secret words would be as simple as regenerating them on the "change password" page. Confirming identity is a separate problem that faces all password-based systems and would not be altered by this scheme. Feb 26, 2014 at 15:59
  • 1
    @KnightOfNi passw0rd isn't on most wordlists. rainbow tables. months. wat. Feb 28, 2014 at 4:40

1 Answer 1


Most passwords these days only have to be good enough to defeat brute-force at the web interface, and to do that they don't have to be all that complex. Given how good password cracking is these days with GPUs, hash tables and rainbow tables if your password database is compromised you'd have to consider them cracked even if they are complex. Plus, if your password database was compromised you'd still want to send new passwords just to cover yourself.

Sure, you could give your users complex passwords which are so hard to remember they have to be written down, and then lost, requiring another one to be sent, which will then be written down and lost. It's a great way to piss off your customers without much net increase in security over simply enforcing good password standards.

  • 1
    I do not agree that you only need to defeat brute-force at the web interface. Most users tend to use the same password on all applications, to break such password would only require to login at the web interface. And there's always the chance of disgruntled employees, exploits and all sorts of password dictionary exposure.
    – Sandokas
    Feb 26, 2014 at 16:34
  • So? That's their problem, users have a responsibility to protect themselves using good passwords. Enforcing good password standards is easy to do and beneficial to both the user and the site owner. Forcing passwords on users will decrease the site's usability and make administration more difficult for little security benefit.
    – GdD
    Feb 26, 2014 at 16:38
  • I am not sure it is not your problem also. In Portugal we just had a Supreme Tribunal case where a client was victim of phishing and successfully sued a bank for it. It is in your interest to keep the users happy by protecting them from attacks at least as much as letting them to choose their passwords. publico.pt/sociedade/noticia/…
    – Sandokas
    Feb 26, 2014 at 16:49
  • 3
    I agree that it is a good idea to protect users from attacks, there are much better ways to do it. Users have bad password habits, why give them more to mismanage?
    – GdD
    Feb 26, 2014 at 16:58
  • 1
    While it's safest to consider your password compromised if it is in a database that gets stolen, the truth may not be so for a strong password. Even with the latest and greatest cracking techniques and hardware, and even assuming relatively weak hashing practices, an attacker is only going to get so far in cracking passwords before they have to resort to brute force. Often at this point, it's more cost-effective to just give up and start exploiting the accounts with passwords you did crack and then move on to the next target(s).
    – Iszi
    Feb 26, 2014 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .