A single word can be transformed in so many ways to create the password. With any word of length l there are l! different permutations. Appending digits and symbols to the word create alphanumeric password. Even the leet transformations(replacing a with @ etc) can be applied to create passwords. The number of such transformations are enormous but only few are memorable and used. The leak of password database leaks provide insights into most common tricks used by the creators of the passwords. But some transformations might be tricky and not known to the attacker yet, because they might not be popular or might not be available in the leaked database . So my question is "Can such tricky and memorable transformations be identified without depending on the or analysing the breached data ?"

My point is that security through obscurity is not going to help. Some human created passwords might be secure only because the tricks are unknown. Understanding such set of tricks, will eventually lead to better strength meters and therefore better sense of security. It will also help to identify if the humans can create secure passwords at all or not? and end the cat and mouse game between the attackers and us? May be it can also imply the replacing the password scheme for authenticating with some other schemes, I am no expert to tell, but these are my concerns.

closed as unclear what you're asking by schroeder, Xander, Steve, Gilles, Iszi Sep 17 '14 at 17:29

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    You're asking if we can identify trends in passwords by not viewing the passwords? – RoraΖ Sep 17 '14 at 14:42
  • You could run surveys and ask people what methods they use .... – schroeder Sep 17 '14 at 14:51
  • what kind of passwords are memorable? yes similar one – Curious Sep 17 '14 at 14:51
  • 1
    @curious As it happens, i'd be happy to share my method for generating passwords; I use Keypass. This is because I do not rely on the generation being secret to keep the actual passwords secret. – Chris Murray Sep 17 '14 at 15:01
  • 1
    @Curious People will share their ACTUAL passwords for candy ... They'll answer questions about their methods to show how clever they are. – schroeder Sep 17 '14 at 15:02

No; by definition, you cannot identify a trend without data.

However, anything that you or I or anybody else can come up with can also be thought of by an attacker. In general, you cannot assume that the attacker cannot or will not find out what method you are using. This is called 'security through obscurity' and is a common trap that people fall into.

  • But there must be some property possessed by memorable passwords. If we try identifying memorable compositions, there will be few who will use password of length 14 and of form LSSSUSSDLDSULS, L- lowecase, U- uppercase, S-symbol, D- digit. Very few are going to use such random compositions – Curious Sep 17 '14 at 15:18
  • That is an interesting question, but it's not one I can answer. Since this is actually a question of letter frequency and how it relates to memory, you'd probably get a better response over at linguistics or cognitive science. – Chris Murray Sep 17 '14 at 15:30
  • You can probably build a rough account of how people came up with such methods but nothing that would provide numbers to the point where you can use information theory to assess the entropy of a specific password alphabet and set of composition rules. Essentially people pick what's easy for them: the least requirement to whatever rules are thrown at them plugged onto an existing word. – Steve Dodier-Lazaro Sep 17 '14 at 15:54

You're asking if you can predict how average human beings would transmute a given word based on a set of transmutation rules, as far as I can understand.

For such a prediction to occur, you need either an evidence-based prior assumption or a predictive model that has been evaluated and whose scope comprises your specific question. The first road is the one of previous breaches, from which you can infer for the same alphabet and rules how words will be transformed. You can then use this information to describe the actual entropy of a password input space -- rather than a "set" entropy that does not take into account the probability distributions of words. In practice you won't have enough data to cover the whole input space of an alphabet so such a metric still relies on some level of extrapolation (i.e. "all the unobserved patterns are equally likely to occur"). Bonneau has a paper on security metrics for passwords that better reflect the reality of how password spaces are used by end users (possibly this one).

The second road would require you to do quite a lot of experimenting with human subjects and devise general rules of how people choose to transmute words based on available symbols. You would do multiple experiments to assess which symbols are preferred, how they are placed, where, and you would need to cover an ecologically valid set of:

  • input alphabets
  • proposed transmutation symbols and rules
  • people
  • interfaces to password authorship and entry
  • social settings (this one just defeats the astonishing majority of security researchers doing human subject research)

It'd be extremely hard and costly to make such a model complete (i.e. accounting for all possible types of transmutations), valid and reliable.

Especially, it is my intimate belief that interfaces have more impact over how people authenticate than passwords (but I have neither the time or motivation to argue this in any scientific way :-) ), and I would be willing to bet that if such a model were made for e.g. desktop computers with a certain type of keyboard it would fail for e.g. tablets with a different keyboard layout (for instance if "@" is available with a lesser interaction cost than "1" on a keyboard it may be preferred for that very reason).

Thinking of this problem from a UX perspective simplifies the matter a great deal: why do people always pick very basic transformations e.g., add a number and a symbol at the end of an existing password? Because it was cheap and easy to do so on an existing password. What did we learn from this? Either we make all options equally painful to the user so that they do randomly pick a password, or we stop asking them such a ridiculously difficult task of selecting random but memorable auth factors.

  • if a different keyboard is given to every user, will he create different passwords. Will this solve the problem of non-uniform distribution over the passwords? For example today every device has the same keyboard layout. But if manufacturer randomly assign alphabet to every key in the keyboard and deploy it to the user. Will it solve the problem> – Curious Sep 17 '14 at 16:22
  • 2
    You can't seriously propose this. People shouldn't have to learn a keyboard layout every time they change their machine, and will outrightly reject such a situation because it puts an unnecessary strain on them. If anything it's important to recognise that security must live side by side with a lot of other, more visible and arguably more important constraints. What I'm saying is that if you evaluate or model human password creation behaviour, you must take into account and document all the particular circumstances of your study environment and apply your results only within that scope. – Steve Dodier-Lazaro Sep 17 '14 at 19:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.