Bad Grammar Make Bestest Password, Research Say 193
An anonymous reader writes "NewScientist reports, 'Along with birthdays, names of pets and ascending number sequences, add one more thing to the list of password no-nos: good grammar.' Researchers from Carnegie Mellon University seem to have developed a password cracking algorithm that targets grammatically correct passwords. Can bad grammar really make your password secure?"
Certainly (Score:3, Insightful)
Re: (Score:2)
In other news, making spelling mistakes defeats a dictionary attack.
Because by spelling the words wrong, they no longer appear in the set of words known as "the dictionary".
Re:Certainly (Score:4, Insightful)
Unless those dictionaries contain common misspellings, which they probably already do.
Re: (Score:3)
It's actually fairly easy to do algorithmically, in the same way many password crackers already try common number/letter replacements (pa55w0rd), adding single digits and dates to the end of dictionary words, capitalizing the first letter or every other letter etc. Just addend -ed and -ing to every word, drop silent k's, reverse i and e (e.g. recieve) and so forth.
Re: (Score:2)
It's actually fairly easy to do algorithmically, in the same way many password crackers already try common number/letter replacements (pa55w0rd), adding single digits and dates to the end of dictionary words, capitalizing the first letter or every other letter etc. Just addend -ed and -ing to every word, drop silent k's, reverse i and e (e.g. recieve) and so forth.
Very true. That's why I find it so amusing when IT people think a system is more secure because their passwords require 1 capitalized letter and 1 number.
Re: (Score:3)
Great. Now I ahve to change my pssaword againz.
Re: (Score:2)
I think the mistake is that they call it a "password" and not a "passphrase".
Most of my better passphrases are made from a few bars of a poem or song I know. Even better, when it comes time to change passphrases every 90 days or so, I can just go on to the next verse without too much thought. The only hard part is not to hum or dance to an obvious tune or rhythm after logging in. And maybe remembering when letters you turn to 133+ if necessary.
e.g.:
Ittrl,itjf(14ls;tnefr
(first verse of 'Bohemian Rhapsody
Re: (Score:2)
Well, if we didn't say it, they'd all make their passwords "password", their own first name, or some other amazingly simple word. [cbsnews.com]
They always glaze over when you try to explain strong passwords. No matter what you tell them, you can always sit down at their desk and say "what's your password?", just to find out it's "Password1" or "1234567A"
Re: (Score:2, Insightful)
Well, if we didn't say it, they'd all make their passwords "password", their own first name, or some other amazingly simple word. [cbsnews.com]
They always glaze over when you try to explain strong passwords. No matter what you tell them, you can always sit down at their desk and say "what's your password?", just to find out it's "Password1" or "1234567A"
For everything outside of my place of work, I use a password safe program and (if I can) at least a 42 character password using the largest possibly set, generated randomly.
At work, where I'm not allowed to use a password safe and am required to memorize no fewer than 30 passwords, most of which have to be updated at least monthly, and cannot use any password I've used in the last 6 months.... my password is my first name and last initial, followed by a number which is how many times I've had to reset it. Y
Re: (Score:2)
Three-tries lockout ... usually ... (Score:2)
Dictionary attacks aren't always that useful for authentication systems that block logins on an account after a few missed attempts. However, a few stripped-down NAS nasties are set to allow infinite login attempts. It was kind of fun watching the password attempts; they were sort of half dictionary, half psychology, lots of old favourites. But they were all single words, I noticed, and not very long at that.
Re: (Score:2)
FTFY
FYFT
Of coarse (Score:5, Funny)
Shekuritee bai aubskureeti.
Re: (Score:2)
Re: (Score:3)
security by obscurity.
And I don't agree with it necessarily being a bad thing unless its the only approach taken. As a layer, it increases the effectiveness of other security.
Re: (Score:3)
It's rapidly becoming apparent that many Slashdotters don't understand the difference between grammar and spelling.
Re: (Score:2)
It's rapidly becoming apparent that many Slashdotters don't understand the difference between grammar and spelling.
Gram are in gram crackers.
Spelling your drink makes a mess.
Spelling your gram crackers makes a mess two but it's not as messie.
Re: (Score:2)
Re: (Score:2)
horzebergur, shoorelay?
Corollary (Score:4, Insightful)
Re: (Score:3)
My typical password reminder is "Fuck you." Good luck figuring out what my password is with that hint :)
Re: (Score:3)
yourplaceormine,bitch?
Re:Corollary (Score:5, Insightful)
Entering wrong infromation for password reminders / security questions.
My opinion is that password hints and security questions are really just a bad idea which websites should possibly stop to use completely. They can easily ruin the whole security even if your password itself is robust.
Re: (Score:2)
Re: (Score:2)
Just use it as a second password prompt with wrong info. For example, "what is your mother's maiden name?" has the answer "correct battery horse staple."
The problem with that approach is that people have lots of accounts, all with different questions. Either you have to memorize the made up answer to every question, or you have to use the same one for all of them, which means that if one place is compromised and didn't store it hashed, all your accounts are now potentially compromised.
Not that answering honestly is any better, because any sleuth worth his beer can find out the information about individuals, or find out the most common answers for large sca
Re: (Score:2)
Answering "Smit", "Johnson" and "Williams" for the three tries you're asked someone's mother's maiden name will get you 2.5% success rate, which is significant for large scale attacks. Your high school? Central, Lincoln and Jefferson will get you a high return rate.
As long as "McCreery" and "Talented and Gifted Magnet High School" aren't in the top 10, I'm safe (and no, I can't use the "official" abbreviation, as most won't take a 3-letter answer - TAG).
Re: (Score:2)
Article is very light on details (Score:5, Interesting)
Re:Article is very light on details (Score:4, Interesting)
Re: (Score:2)
Re: (Score:3)
It would be better to have no grammar structure at all in passwords, good or bad. Select a random assortment of words, not words that can be strung together using conventional grammar rules, or even distortions of conventional grammar rules.
And transform any words in such a way, that no word used is a legitimate word.
3hav-ayekatkitt-ees
Re: (Score:2)
Which achieves one goal at the cost of memorability. Particularly if you want a password that can survive an offline brute force cracking attempt as opposed to guessing over the network it should be 20+ characters long because each character only adds 8 bits of entropy - in practice more like 6 bits. Looking at it the other way from the would-be cracker's perspective, what do you have? Brute force attacks and dictionary attacks. The easiest way to avoid both is to take a long, easy to memorize phrase and fu
Re: (Score:2)
Correct horse battery staple! http://xkcd.com/936/
th@res_morethan1way2cat@file (Score:2)
Yoda ask -- answers he will give?
even Something like this" could screw up a grammer based guesser .
Don't think (Score:2)
If Music Be The Food Of Love, Log In (Score:4, Interesting)
Here is an example of a musical login: pvy89pvvv[890[]vv
For this example, position your right hand with the thumb on the 'v' key, then play the sequence as if they were notes, then listen to C.P.E. Bach - Minuet In G Major for what it should really sound like.
If you like impressive music, try: uppvyuvyyyyuyvvyuvyuppvyuvyyyyuyvvyuyv
Leo Arnaud - Buglers Dream
Re: (Score:2)
Try that in an ipad or any other non-keyboard device. I don't think it will work for some of those devices..
Re: (Score:2)
do you not see the repartition there, that method produces terrible passwords. how is pressing the same key exactly 4 times in a row at speed?
They are getting strong enough not to low fruit and fall to a mass hash cracking but someone only has to observe you typing that in from a distance once, observe your fingers not move, and will rearrange word list to favor small character spaces.
PS when you put this method on the internet you can no longer use it unless you never reuse you user-name.
Lockout DOS (Score:3)
In fact, even if you have a shit password (e.g., "changeme1234"), if the website limits the number of tries to 3 times a day, you're probably safe for at least a year or two.
Except from denial of service, where someone with a list of usernames he wants to attack enters those usernames with "P00-p00" as the password three times in a row. Then the legitimate owners of those accounts can't log in.
Better than bad grammer... transcription! (Score:2)
I find that an even better way to construct a password (that you can still remember) is to use a language other than English for all or part of it. More specifically, it works best if you use a language that that requires transliteration to type in the Latin character set and then use your own transliteration/transcription spelling (rather than, necessarily, the common or "official" one). Good examples might be words in Hebrew, Russian or Greek.
Consider the Russian word for 'good'. I will spell it using
Yoda passwords? (Score:2)
Re-framing old wisdom to create newness goodness! (Score:2)
Re: (Score:2)
It is a well known fact that choosing words you will find in a dictionary as your password is not a good idea.
It's a better idea than a single word, or name, which is what many people still do. Anyway, even if you use real words, with the English language having well over 100,000 words, a few words gives you a very, very large space. Using correct grammar cuts it down, of course. But TFA was about attacks trying billions of passwords. What kind of idiotic system allows someone to attempt to login billions of times at high speed?
Re: (Score:2)
A large space, but still an easily searchable one, given enough time, and a system that allows dictionary attacks, which many do, even though it would be easy enough to disallow it.
So why do that, when it's easy enough to use words that are still words, but not words in standard dictionaries? (i.e. names of fictional characters, words made up by the company you work for or that are specific jargon of your field, internet memes, etc.)
Re: (Score:2)
So why do that, when it's easy enough to use words that are still words, but not words in standard dictionaries? (i.e. names of fictional characters, words made up by the company you work for or that are specific jargon of your field, internet memes, etc.)
Because the "geekily obscure" words like that are the very first ones that will be checked. Geeks have been using words from Tolkien and such as logins and passwords from the dawn of time.I remember one guy who was mystified that his password "THX-1138" had been cracked by someone... I had a hard time not laughing.
so this is a good one? (Score:2)
@11yourbA5es@r3Be10ngtoUS
"Can bad grammar make your password secure?" (Score:2)
Yes, if it is bad enough. Examples:
Sp/k)]Vi5PTa
h@#FZh_\,
_HA67C_1N{vh
Of course no password is secure if you use on more than one site.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
This means that most slashdot posters are safe. Seriously, the worst spelling and grammar I see online are right here amongst what should be a well-educated group of people.
It's even uprated seemly for the bad grammar and spelling. I think it's a sign saying "I'm not a bot - at least not a simpleton".
Grammar? (Score:2)
If grammar is relevant at all, your password should already be long enough to be pretty secure.
mixing languages is even better (Score:2)
I speak English and Swedish. I find it easy to concoct "Swinglish" words and phrases that are invalid in any language yet easy for me to remember.
I think that ought to be secure.
Use phrases (Score:2)
I usually think of a phrase, take the first letter of each word, and leetify some of the letters. "My what a lovely unicorn with no horn you have" becomes MwalUwnHuh which then becomes Mw@lUw!Huh.
My phrases are generally song lyrics, and yes I do need to write them down until I've used them 3-4 times.
All your base (Score:2)
this is really, really simple (Score:2)
makes passwords easy to communicate (Score:2)
Inuit (Score:2)
Personally, I'd go for words in the inuit language(s). Inuit words are so wonderfully impossible to guess from a dictionary because of the nature of the language; consider the following example:
umiaq: a large boat - a 'wife boat'
umiarssuaq: a big wife boat - ie a ship
umiarssualivik: a place for a ship: a harbour
umiarssualivinnguaq: a small harbour
etc
Combine that with a complex grammar and the fact that the rules for spelling are somewhat uncertain, and you have the perfect passwords, easy to remember and wr
Well, (Score:2)
Can bad grammar really make your password secure?
not any longer.
Text Message-language has a purpose ?! (Score:2)
So, are you telling me, that fascinating (unreadable) short-text/sms-language has a purpose after all?! :)
Re:obvisouly (Score:5, Funny)
Re:My question is this: (Score:5, Insightful)
Re:My question is this: (Score:5, Insightful)
A paranoid colleague of mine composed passwords with a sprinkling of extended chars. He entered the whole thing on the numeric keypad with ALT held down.
I've no idea what his password(s) were, but they caused quite a few badly written apps to explode in a spectacular shower of exceptions and unhandled input errors.
Re: (Score:2)
Re: (Score:2)
That's great until you have to use a different keyboard layout.
Or a different operating system which uses a different method of entering extended characters.
Re:My question is this: (Score:4, Insightful)
Because not all systems can handle Unicode, and Unicode itself has multiple internal representations (UTF-8, UTF-16.) Furthermore, there are multiple valid Unicode encodings for the same character stream. In other words, that would be a very bad idea unless you are in an environment where only company approved systems, set up by competent system administrators, are allowed to log in, in which case it would just be a bad idea sans the "very". Even then it is of little value, since a well chosen password still has plenty of entropy, and there is no need to add complexity to the auth system (complexity is the enemy of security.)
Re: (Score:2)
Because not all systems can handle Unicode
I was under the impression that any system that could handle XML or HTML5 could handle at least the Basic Multilingual Plane of Unicode in UTF-8 encoding.
Furthermore, there are multiple valid Unicode encodings for the same character stream.
The Unicode Standard describes several canonicalization processes that can be applied before hashing the password for storage.
Re: (Score:2)
Were you also under the impression that all systems can handle XML and HTML5, and that all systems are UTF-8?
So which one do I pick? Where is your actual argument that there is a benefit to using Unicode for passwords? Most im
Re: (Score:2)
Because not all systems can handle Unicode, and Unicode itself has multiple internal representations (UTF-8, UTF-16.) Furthermore, there are multiple valid Unicode encodings for the same character stream.
Just take whatever is given into canonically pre-decomposed UTF8. I mean there are people using Unicode in their file system and they have no problems with this.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Exactly the point! In the real world software is implemented by humans, and sometimes even that which should be obvious eludes them ;-) When you implement additional complexity you increase the chance to introduce an exploitable bug into the system. Again, complexity is the enemy of security. I'm guessing you do
Re: (Score:2)
Because not all systems can handle Unicode, and Unicode itself has multiple internal representations (UTF-8, UTF-16.) Furthermore, there are multiple valid Unicode encodings for the same character stream.
You've just said one thing twice in two sentences.
Re: (Score:2)
Re: (Score:2)
Every site should allow any password if they just hash it like they should.
I consider restricting the character set a lesser crime than sites like Amazon, Blizzard that make passwords case-insensitive
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Randomized passwords are the best (Score:5, Insightful)
Re: (Score:2)
Re:Randomized passwords are the best (Score:5, Insightful)
I don't have a different phone number for every person I call. People I call do not make up rules like my phone number must be at least x characters long, must have a special character in it, can not have a special character in it, must not begin with an upper case letter, must begin with a character, must begin with an emoticon ;-)
and I don't know what other crap they are about to come up with...
Land lines in multi-person households (Score:2)
You must know a lot of people that share the same phone.
That I do. Many are land lines in multi-person households. And being public keys (in the SQL "primary key" sense, not the cryptographic sense), they don't change every 45 days.
Re: (Score:2)
Public keys? Do you mean natural keys?
Public natural keys and private natural keys (Score:2)
Re: (Score:2)
How old are you exactly?
I have seen you say this before and I find it hard to believe. Other than my parents and grandparents I know no non-work landline phone numbers. I can't imagine most people under 55 even have them, or if they do use them that often.
Re: (Score:2)
Other than my parents and grandparents I know no non-work landline phone numbers. I can't imagine most people under 55 even have them, or if they do use them that often.
True, people who currently or will soon qualify for old-age social insurance programs are more likely to have land lines because they tend to be late adopters in general. So are parents of kids who aren't yet old enough to have their own cell phone. So are people who don't have cable television service, as they're often offered a POTS or fiber land line for free or nearly free with the purchase of Internet access from the phone company.
Re: (Score:2)
None of my friends who have young kids have landlines. The kids use skype to talk to grandma and grandpa or Mom and Dad's cell phones. I fall into that last category and the fiber phone line is no where near free. I get FIOS for $40/month, adding a phone would double that, or I could get cable I do not want and a phone I do not want for $99/month.
Comment removed (Score:5, Funny)
Re: (Score:2)
None of your phone numbers are changed every 30/60/90 days, while some of your passwords are.
My recommendation for such passwords, is to memorize a "base" password; and define a rule to increment the base password, so all you need to remember is the original password, and which number you are at, and do a mental transformation; this is far more secure than writing down the password, or picking easy to guess passwords.
eg
Password 0 helloworld0
Password 1 ifmmpxpsme1
Password 2 jgnnqyqtnf
Re:Randomized passwords are the best (Score:5, Interesting)
I don't memorize phone numbers, I memorize the 3x4 grid pattern required to dial it.
Re: (Score:2)
Re:Randomized passwords are the best (Score:4, Informative)
Re: (Score:2)
I tend to use random passwords myself. The trick I've learned to memorizing them is to take advantage of the fact that the human brain is good at seeing patterns even when there aren't any. So I just look at the password for a bit, let myself come up with a pattern or way to describe it and memorize that. I'll often think of a password as chunks of 3 or 4 letters and just remember the junks normally associated with a thought phrase. If I can't come up with something I'll just hit regen again til I get somet
Re: (Score:2)
I use random, unique passwords most everywhere. The trick to remembering them is not to try - I just store them in my encrypted keychain. It's not that hard to memorize one long and complex password.
Re: (Score:2)
Re: (Score:2)
I also store my passwords in an encrypted keychain, but sometimes it's nice to be able to get some passwords without having to look it up. For example both iTunes and Windows RT require me to enter passwords when buying new apps or add-ons. Switching to another app to cut & paste in the password will often cancel the sale. So I memorized those passwords because it's simpler. Likewise when administrating machines at work I don't want to have to dig up my keychain just to log into the server farm, especia
Re: (Score:2)
I agree, actually - and I do have my more frequently-used passwords memorized (e.g. my account at work; my Gmail account; my iTunes account; particular server passwords).
Heck, for accounts I regularly use it would've been hard NOT to memorize the passwords!
Re: (Score:2)
Sure, as long as you only need the one password.
Re: (Score:2)
Re: (Score:2)
"Let me in" and "I love you" are both correct grammar. You're perhaps thinking of correct punctuation.
Re: (Score:2)
"Let me in" and "I love you" are both correct grammar.
Indeed. So it clearly would be best if we all switched to "letiin" and "ilovesyou".