{"id":318,"date":"2009-06-01T09:33:57","date_gmt":"2009-06-01T14:33:57","guid":{"rendered":"http:\/\/vgable.com\/blog\/2009\/06\/01\/pass-phrases-not-passwords\/"},"modified":"2009-06-22T02:13:53","modified_gmt":"2009-06-22T07:13:53","slug":"pass-phrases-not-passwords","status":"publish","type":"post","link":"https:\/\/vgable.com\/blog\/2009\/06\/01\/pass-phrases-not-passwords\/","title":{"rendered":"Pass Phrases, Not Passwords"},"content":{"rendered":"

Thomas Baekdal makes a convincing argument for using pass-phrases<\/em> not passwords<\/em><\/a> (via<\/a>). It’s excellent advice, and I know I’m not alone in having advocated it for years. <\/p>\n

My keyboard has 26 letters, 10 numbers, and 12 symbol keys, like ~. All but spacebar make a different symbol when I hold down shift, giving me 93 characters to use in my passwords. But the number of words that can make-up a pass-phrase is easily<\/a><\/em> in the 100,000s<\/strong>. Estimating exactly how big is a bit tricky, but I will stick with 250,000 here (I think it’s an undercount<\/em>, more on this later).<\/p>\n

We Know How To Talk<\/h3>\n

The human brain has an amazing<\/em> aptitude for language. But “passwords” aren’t really words, so they don’t tap into this ability. In fact, we often use words<\/em> to try and remember the nonsense-characters of a password<\/strong>.<\/p>\n

Wouldn’t it make more sense to just use the words directly, if we can remember them more easily?<\/p>\n

Hard For Computers, Not Hard For Us<\/h3>\n

People feel<\/em> that if security system A is harder for them to use then system B, then A must be harder for an attacker to bypass<\/strong>. But the facts don’t always match this intuition.<\/p>\n

What authentication code do you think is harder for a bad guy to hack, the 7 character strong password<\/a> “1Ea.$]\/”, or the mnemonic for the first 3 characters, “One Elvis Amazon”? Certainly “1Ea.$]\/” is harder for a person to remember. It feels<\/em> like it should<\/em> be harder to break. But a computer, not a person, is going to be doing the guessing, and all it cares about is how big the search space is. There are 937<\/sup> possible 7 character passwords. Let’s say there are 250,000 possible English words (more on that figure later). Then there are 250,0003<\/sup> 3 word combinations — meaning an attacker would have to do 260 times<\/em> more work to guess “One Elvis Amazon” than to guess “1Ea.$]\/”.<\/p>\n

With pass phrases, easier for the good guys is also harder for the bad guys.<\/p>\n

Exactly How Much Harder<\/h3>\n

The “250,000 word” figure is a bunch of hand-waiving, but I believe it’s an undercount<\/em>. I picked it, because I wanted a round number to crunch; it’s what Thomas Baekdal<\/a> picked; and it’s about the size of the Mac OS X words file<\/a>,<\/p>\n

\n$ wc -l \/usr\/share\/dict\/words \n  234936<\/pre>\n
But liberally descriptive linguists say that the 1,000,000th word will be added to the English Language on June 10th, 2009<\/a>. The more conservative Webster’s Third New International Dictionary, Unabridged<\/cite> list 475,000 English words. Obviously neologisms, slang, and archaic terms are fine for pass phrases<\/strong>. People like<\/em> discovering quirky words<\/a>. I see far more more people embracing the login, “kilderkin of locats”, then rejecting it.<\/p>\n
Different conjugations (can) count as different words in pass-phrases.<\/strong> There’s only one entry in a dictionary for swim, but swim, swimming, swam, etc. make for distinct pass-phrases (eg. “Elvis swims<\/strong> fast”, “Elvis swam<\/strong> fast”, etc. Both phrases don’t show up in a google search by the way.) So the real number of words should be a few fold larger than a dictionary indicates<\/strong>.<\/p>\n
But not all words are equally likely to be chosen<\/strong> — just as some characters are more popular in passwords<\/a>. My earlier figure of “2500003<\/sup> 3 word combinations” was based on the naive assumption that each of the 3 words is independent<\/a>. But people do not pick things at random<\/a>. And a phrase is by definition<\/em> not completely random — it must have some structure<\/a>. I’m unaware of research into exactly how predictable people are when making-up pass-phrases. <\/p>\n
But given how terrible<\/em> we are at picking good passwords, and how good we are at remembering non-nonsense-words, I am optimistic that we can remember pass-phrases that are orders of magnitude harder to guess than the “good” passwords we can’t remember today.<\/p>\n
Fewer Ways To Fail<\/h3>\n
We’ve all locked ourselves out of an account because of typos or caps lock<\/a>. But pass-phrases can be more forgiving.<\/p>\n
Pass-phrases are casein<\/em>sensitive. There’s no need to lock someone out over “ELvis…”.<\/p>\n
Common typos can be auto-corrected, much as google automatically suggests words. Consider the authentication attempt “Elvis Swimmms<\/em> fast”. The system could recognize that “Swimms” isn’t a word, and try the most likely correction, “Elvis Swimms<\/strong> fast” — if it matches, then there’s no reason to ask the user if it’s what they really meant. (Note that only one pass-phrase is checked per login attempt.) I don’t have hard data here, but given how successful google is at interpreting typos, I’d expect such a system to work very well.<\/p>\n
Pass-phrases might be more difficult on Phones, and similarly awkward to write with<\/a> devices. Writing more letters means more work. Predictive text<\/a> can only do so much. Repeatedly typing 3 letters and<\/em> accepting a suggestion is clearly more work then just tapping out 6 characters. Additionally, there are security concerns with a predictive text system remembering your pass-phrase, or even a small part of it. <\/p>\n
But for computers, pass phrases look like a clear usability win.<\/p>\n
Easily Secure Conclusion<\/h3>\n
(In case you were wondering that was a unique phrase<\/a> when I wrote this.) Using pass-phrases<\/em> over passwords (which are really pass-strings-of-nonsense-sybols-that-nobody-can-remember<\/a>) makes a system significantly harder to crack. Pass-phrases are easier for humans to remember, and a system that uses them can be very forgiving. But as always, the devil is in the details. It’s terrifying to be an early adopter of a new security practice, even if it seems sound.<\/p>\n","protected":false},"excerpt":{"rendered":"
Thomas Baekdal makes a convincing argument for using pass-phrases not passwords (via). It’s excellent advice, and I know I’m not alone in having advocated it for years. My keyboard has 26 letters, 10 numbers, and 12 symbol keys, like ~. All but spacebar make a different symbol when I hold down shift, giving me 93 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16,11,42,8],"tags":[297,187,434,311,433],"class_list":["post-318","post","type-post","status-publish","format-standard","hentry","category-accessibility","category-research","category-security","category-usability","tag-authentication","tag-english","tag-pass-phrases","tag-password","tag-randomness"],"_links":{"self":[{"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/posts\/318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/comments?post=318"}],"version-history":[{"count":0,"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions"}],"wp:attachment":[{"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/media?parent=318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/categories?post=318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vgable.com\/blog\/wp-json\/wp\/v2\/tags?post=318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}