5 ms·

I think programmers should try to use code as much as possible for their password. Some simple expression involving an array of something and an operation on it

I think programmers should try to use code as much as possible for their password. Some simple expression involving an array of something and an operation on it complete with the result. Easy to remember and I think pretty hard to guess since it involves a lot of symbols, letters, numbers, underscores, dashes, spaces, equal signs, etc (unless I'm missing something obvious, which is totally possible given I'm no security expert).

Raphmedia 13y ago
Awesome idea! Something as simple as "if(password){logmein()}" would be quite hard to brute force I believe.
- Tloewald 13y ago
  The problem for me is that as soon as you start using a clever password system like this you discover so many sites with idiotic restrictions (I'm looking at YOU banking websites) won't allow most of them. I've taken to using 1Password, but constantly have to dumb down its password generator, and it's almost always for financial institutions (which tend to have maximum password lengths -- which is truly scary in its implications -- and generally don't allow most non alphanumeric).
  - cuu508 13y ago
    ah, the maximum length... I've seen more than one site which would say "password is too short" if the password is longer than 16 characters.
    - Tloewald 13y ago
      Actually dropbox used to do that.
  - Raphmedia 13y ago
    YES! My bank limit my online password to be pretty much the same a nip number. Are they crazy? A few numbers is enough when you need a physical card and to stand in front of a camera... but it's not when you are online.
  - fpgaminer 13y ago
    And worst are websites that block pasting passwords, for some unknown reason. Then I can't copy-paste the KeepPass generate password. Have to either type it manually, or mess around with the auto-type settings. Government website have been the biggest offenders here, in my experience.
simbolit 13y ago
I think what you are doing is creating a mnemonic for a long pass phrase, which is a good thing. A longer password is, ceteris paribus, a better password. The only problem is remembering it. If you can memorise code better than phrases, this is a good strategy.
- aaronem 13y ago
  The only other problem is accurately blind-typing it, which I've found to be a drawback of the XKCD-style passphrase as well. Given a little practice, I can fit about a twelve-character password, complete with punctuation &c., into muscle memory -- anything longer than that, and the error rate rises to a point where logging in in the morning becomes a trial.
  - simbolit 13y ago
    really? i regularly type 30+ character passphrases with <5% error rate. i'd say i mistype my password once a month or so.
tga_d 13y ago
Any time your password uses a pattern, it by definition has low entropy. I don't know of anyone that has calculated the entropy of code, but I'm guessing it's even lower than that of an English sentence (~1.1 bits per character is a common estimate) since the rules are more strict. If we estimate 1 bit per character (and honestly I think that might be high), then you'd need your password to have around 100 characters to be strong. I have a blog post where I try to explain entropy in easy to understand terms that might help understand this: http://tgad.wordpress.com/2013/09/18/what-is-entropy/ http://tgad.wordpress.com/2013/09/18/what-is-entropy/ But the main problem with your reasoning is the idea that passwords with large character pools are more secure (i.e. have more entropy). This is a common belief, but isn't necessarily true. If the characters in your passphrase are completely randomly selected from the pool, then yes, a passphrase of length n will have more entropy if the character pool is larger. But you aren't randomly selecting the characters, you're pulling them from a grammar which is a very small subset of all possible combinations. Therefore, the security of your password relies on the secrecy of the mechanism, which is not a good idea, since if your method becomes popular (and as they say, there's nothing new under the sun), then password crackers will just start generating passwords like yours.
- crpatino 13y ago
  Theoretically, you are of course right. In practice, it is a tradeoff. If you have already decided that the password for this particular computer/application/website does not entail the use of password DB, it is a good option. You are on purpose selecting a low entropy password, just one whose underlying pattern is hard to guess by a would-be attacker. I would not use this kind of approach for any account that makes it obvious that I am a programmer (aajem, HackerNews)... but for the general population, the attacker is not likely to target YOU, but the average user of such and such site.
  - tga_d 13y ago
    Maybe I'm missing something, but that doesn't make any sense to me. I'm not critiquing the use of low entropy passphrases (though if very low then they become useless) - as I said in my blog post: ... a passphrase is most useful if you can remember it and use it. While having 100 bits of entropy is something nice to shoot for, one has to look at their threat models and decide if it’s worth it. Is having a passphrase 8 words long really the price you pay to keep hackers out of your lolcats.rus account? Maybe yes, maybe no. The truth is, for most web accounts, 100 bits of entropy is overkill. My point is that there is no advantage of relying on a passphrase you don't know the entropy for, since it's usually lower than what you thought, and there are methods of generating memorable passphrases that you can actually measure the entropy. I guess I just don't understand why one would ever let their security rely on the incompetence of a potential attacker, instead of relying on the math, when they're both basically just as easy.

Raphmedia 13y ago

Awesome idea! Something as simple as "if(password){logmein()}" would be quite hard to brute force I believe.

Tloewald 13y ago
The problem for me is that as soon as you start using a clever password system like this you discover so many sites with idiotic restrictions (I'm looking at YOU banking websites) won't allow most of them. I've taken to using 1Password, but constantly have to dumb down its password generator, and it's almost always for financial institutions (which tend to have maximum password lengths -- which is truly scary in its implications -- and generally don't allow most non alphanumeric).
- cuu508 13y ago
  ah, the maximum length... I've seen more than one site which would say "password is too short" if the password is longer than 16 characters.
  - Tloewald 13y ago
    Actually dropbox used to do that.
- Raphmedia 13y ago
  YES! My bank limit my online password to be pretty much the same a nip number. Are they crazy? A few numbers is enough when you need a physical card and to stand in front of a camera... but it's not when you are online.
- fpgaminer 13y ago
  And worst are websites that block pasting passwords, for some unknown reason. Then I can't copy-paste the KeepPass generate password. Have to either type it manually, or mess around with the auto-type settings. Government website have been the biggest offenders here, in my experience.

simbolit 13y ago

I think what you are doing is creating a mnemonic for a long pass phrase, which is a good thing. A longer password is, ceteris paribus, a better password. The only problem is remembering it. If you can memorise code better than phrases, this is a good strategy.

aaronem 13y ago
The only other problem is accurately blind-typing it, which I've found to be a drawback of the XKCD-style passphrase as well. Given a little practice, I can fit about a twelve-character password, complete with punctuation &c., into muscle memory -- anything longer than that, and the error rate rises to a point where logging in in the morning becomes a trial.
- simbolit 13y ago
  really? i regularly type 30+ character passphrases with <5% error rate. i'd say i mistype my password once a month or so.

tga_d 13y ago

Any time your password uses a pattern, it by definition has low entropy. I don't know of anyone that has calculated the entropy of code, but I'm guessing it's even lower than that of an English sentence (~1.1 bits per character is a common estimate) since the rules are more strict. If we estimate 1 bit per character (and honestly I think that might be high), then you'd need your password to have around 100 characters to be strong. I have a blog post where I try to explain entropy in easy to understand terms that might help understand this: http://tgad.wordpress.com/2013/09/18/what-is-entropy/ http://tgad.wordpress.com/2013/09/18/what-is-entropy/ But the main problem with your reasoning is the idea that passwords with large character pools are more secure (i.e. have more entropy). This is a common belief, but isn't necessarily true. If the characters in your passphrase are completely randomly selected from the pool, then yes, a passphrase of length n will have more entropy if the character pool is larger. But you aren't randomly selecting the characters, you're pulling them from a grammar which is a very small subset of all possible combinations. Therefore, the security of your password relies on the secrecy of the mechanism, which is not a good idea, since if your method becomes popular (and as they say, there's nothing new under the sun), then password crackers will just start generating passwords like yours.

crpatino 13y ago
Theoretically, you are of course right. In practice, it is a tradeoff. If you have already decided that the password for this particular computer/application/website does not entail the use of password DB, it is a good option. You are on purpose selecting a low entropy password, just one whose underlying pattern is hard to guess by a would-be attacker. I would not use this kind of approach for any account that makes it obvious that I am a programmer (aajem, HackerNews)... but for the general population, the attacker is not likely to target YOU, but the average user of such and such site.
- tga_d 13y ago
  Maybe I'm missing something, but that doesn't make any sense to me. I'm not critiquing the use of low entropy passphrases (though if very low then they become useless) - as I said in my blog post: ... a passphrase is most useful if you can remember it and use it. While having 100 bits of entropy is something nice to shoot for, one has to look at their threat models and decide if it’s worth it. Is having a passphrase 8 words long really the price you pay to keep hackers out of your lolcats.rus account? Maybe yes, maybe no. The truth is, for most web accounts, 100 bits of entropy is overkill. My point is that there is no advantage of relying on a passphrase you don't know the entropy for, since it's usually lower than what you thought, and there are methods of generating memorable passphrases that you can actually measure the entropy. I guess I just don't understand why one would ever let their security rely on the incompetence of a potential attacker, instead of relying on the math, when they're both basically just as easy.