3

I was watching a TED Talk about password security recently which covers quite a few different types of passwords and compares how secure they are and how easy they can be remembered.

One type of password that wasn't mentioned, however, is what I call "pattern passwords". Those are passwords like "vbfhrudjxm" or "cde3$RFVbgt5" which follow a pattern on the keyboard:

An image showing the pattern of the two passwords as typed on a keyboard as arrows

My naive assumption is that even though their entropy is clearly lower than that of true random passwords of the same length they should have a comparably strength against dictionary and brute force attacks while at the same time they are much easier to remember and type. Is this assumption correct?

One disadvantage is of course that if you remember the pattern rather than the actual characters you might run into problems if you encounter a keyboard with another layout (especially with non-alphanumeric characters) but that can be a problem with other types of passwords too.

This question about pattern lock on touch devices is related but those offer a lot less possible combinations and are usually shorter and this question also talks about "pattern based" passwords but in the sense of a pattern in the structure of the password rather than a pattern on the input device.

  • i used to call these qwerty passwords ... just think of the keyboard layout as an added layer of (obviously very weak) dictionary encryption – Skaperen Jun 16 '15 at 10:33
  • You're asking the wrong question, as is customary when talking about password "strength" or "security". The primary factors that affect the expected lifetime of an authentication factor are how often it is used and where is it easier to steal/capture. This being said I've got colleagues who performed studies with grid-shaped graphical auth factors (to be published) and they've realised that most participants picked overly simplistic patterns, making attacks trivial. Then again, I don't base my appreciation of auth factor quality on lab studies... Too many confounding factors usually. – Steve Dodier-Lazaro Jun 16 '15 at 16:34
2

Some wordlists such as rockyou have these sequences in them, so it won't be that safe against a dictionary attack; since dictionary attacks often don't just include normal English words anymore.

Furthermore some tools (autocrack, keywalker, ...) exist that specifically test for these, and as Chriss Murray pointed out, it lowers your entropy.

1

This would appear to be better against dictionary and brute force attacks, yes. However, the attacker is not going to limit himself to these types of attacks.

The problem with approaches like this, is that they're only secure as long as the attacker doesn't find out that you are generating passwords this way. If the attacker knows that you generate passwords like this (which you should assume they do, see Kerckhoff's Principle), they can try various patterns based on your keyboard type, instead of having to try every single combination of letters.

Further, this approach actually lowers entropy significantly. For example, if the first letter is 'x', then I know that only 'z','s','d','c' and space are valid as the next letter, which is significantly less than every other letter/number/special character on the keyboard.

  • i've seen a variant where a pattern on the left side of the keyboard alternated with a pattern on the right side – Skaperen Jun 16 '15 at 10:37
  • @Skaperen, that doesn't actually increase entropy, as it alternates in a predictable pattern. – Chris Murray Jun 16 '15 at 10:52
1

Like most password generation algorithms, this one relies on security through obscurity.

As long as nobody suspects that you use this method, nobody will use a cracking tool which tries passwords based on trivial patterns on a QWERTY keyboard. But as soon as someone suspects that you might be using it, this would change. As soon as someone feels compelled to write a tailored cracking routine, you have to look at how much entropy there really is in your patterns.

Not counting the num block (which would be a bad idea because you can't get to the letters that way), there are 46 keys on your keyboard you can start with. So the first key would have an entropy of 5.5 bytes. From each key there are between 6 and 2 possibilities how you could proceed. I am too lazy to calculate the average and there is also the caps key you press at some moment and release at another, so I'll be generous and assume there are always 8 possibilities on average which is equivalent to 3 bit of entropy. The pattern cde3$RFVbgt5 has an entropy of (5.5 + 3 * 11) 38.5 bit of entropy (388.7 billion patterns). That is equivalent to a completely random password potentially using the whole printable ASCII charset of 6 characters.

Far too weak for any system which needs to withstand a brute force attack.

  • Excellent overview. This is only safe until somebody looks for it. After that, it's simply a matter of entropy. – Mac Jul 22 '18 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.