Cow’s Blog

November 1st, 2006

Came across an interesting article which argues the case for replacing passwords with passphrases. So instead of authenticating into websites with passwords such as qwerty or password123, we may authenticate using a passphrase such as "This is my very secret password" or "Ooh Ah, Cantona".

Jeff Atwood says:

"Passwords are fundamentally broken because they aren’t compatible with normal human behavior… We have to encourage users to stop thinking of passwords as single words, and start thinking of them as pass phrases. The worst imaginable pass phrase (eg, "this is my secret password") is many times more secure than an average single word password (eg, "god123"). And it’s easier to remember."

I certainly think it’s an interesting idea. Especially as many users choose simple passwords for fear of forgetting it; a sentence may better relate to a certain blog or website. For example, someone may choose "This site is way too blue" as their passphrase on this blog; which is a ton easier to remember and to link to this site.

Passphrases would be a lot harder for an automated script to crack. Assuming 70 different characters can be used in a password (26 uppercase letters, 26 lowercase letters, 10 digits and some punctuation), an 8 letter password would have something like 70^8 combinations. An 8 word passphrase could have something like 500000^8 combinations.

There are some flaws in the arguments - sentences obey certain rules and since many people will probably use sentences as their pass phrases, an intelligent script could work out the sentence in a lot less guesses. Further more, if somebody manages to read the first few letters as they are typed on the keyboard, they may be able to guess the rest of the phrase. If I saw one of my friends type "Sta" I may hazard a guess at "Stargate is good/awesome" as a passphrase.

Also, there are some considerations to do with how much leeway we allow on the passphrase. With the passphrase "The Firefox jumped over the Opera", should the passphrase be accepted if Firefox is not capitalized? Should it be accepted if a word is missed out? With pass phrases, it may sometimes be hard to remember the exact word order and the location of all the punctuation.

Any thoughts? 

Via OneCommune.

• Internet , Web Development
• Comments(5)