How secure are "pattern" passwords?

Question

I was watching a TED Talk about password security recently which covers quite a few different types of passwords and compares how secure they are and how easy they can be remembered.

One type of password that wasn't mentioned, however, is what I call "pattern passwords". Those are passwords like "vbfhrudjxm" or "cde3$RFVbgt5" which follow a pattern on the keyboard:

My naive assumption is that even though their entropy is clearly lower than that of true random passwords of the same length they should have a comparably strength against dictionary and brute force attacks while at the same time they are much easier to remember and type. Is this assumption correct?

One disadvantage is of course that if you remember the pattern rather than the actual characters you might run into problems if you encounter a keyboard with another layout (especially with non-alphanumeric characters) but that can be a problem with other types of passwords too.

This question about pattern lock on touch devices is related but those offer a lot less possible combinations and are usually shorter and this question also talks about "pattern based" passwords but in the sense of a pattern in the structure of the password rather than a pattern on the input device.

Answer 1

Some wordlists such as rockyou have these sequences in them, so it won't be that safe against a dictionary attack; since dictionary attacks often don't just include normal English words anymore.

Furthermore some tools (autocrack, keywalker, ...) exist that specifically test for these, and as Chriss Murray pointed out, it lowers your entropy.

Answer 2

This would appear to be better against dictionary and brute force attacks, yes. However, the attacker is not going to limit himself to these types of attacks.

The problem with approaches like this, is that they're only secure as long as the attacker doesn't find out that you are generating passwords this way. If the attacker knows that you generate passwords like this (which you should assume they do, see Kerckhoff's Principle), they can try various patterns based on your keyboard type, instead of having to try every single combination of letters.

Further, this approach actually lowers entropy significantly. For example, if the first letter is 'x', then I know that only 'z','s','d','c' and space are valid as the next letter, which is significantly less than every other letter/number/special character on the keyboard.

Answer 3

Like most password generation algorithms, this one relies on security through obscurity.

As long as nobody suspects that you use this method, nobody will use a cracking tool which tries passwords based on trivial patterns on a QWERTY keyboard. But as soon as someone suspects that you might be using it, this would change. As soon as someone feels compelled to write a tailored cracking routine, you have to look at how much entropy there really is in your patterns.

Not counting the num block (which would be a bad idea because you can't get to the letters that way), there are 46 keys on your keyboard you can start with. So the first key would have an entropy of 5.5 bytes. From each key there are between 6 and 2 possibilities how you could proceed. I am too lazy to calculate the average and there is also the caps key you press at some moment and release at another, so I'll be generous and assume there are always 8 possibilities on average which is equivalent to 3 bit of entropy. The pattern cde3$RFVbgt5 has an entropy of (5.5 + 3 * 11) 38.5 bit of entropy (388.7 billion patterns). That is equivalent to a completely random password potentially using the whole printable ASCII charset of 6 characters.

Far too weak for any system which needs to withstand a brute force attack.