seven unrelated words as passphrase

rblampain · 02-03-2021, 11:09 PM

According to this article

Quote:

https://theintercept.com/2015/03/26/...ers-cant-guess

the human brain has some difficulties to remember seven unrelated words used to form a secure passphrase but can do it with a little practice. In a scenario in which two such passphrases are necessary, it seems that remembering 2 passphrases becomes exponentially more difficult.

Being no expert in security, I thought that a user could learn to remember 7 words of a passphrase supposed to be unbreakable and modify them to create a second passphrase. Examples:

Quote:

passphrase 1:
cult paoli pal finn juice onward ross
passphrase 2:
cultm paolii palc finnh juicea onwarde rossl

The letters of the word "michael" having been used to add 1 letter to each word, the extra thing to remember would only be how each of the 7 words have been modified.
Although there could be some sort of predictability and loss of entropy in such practice, I can not see how.

My question: would such modification of the words affect negatively the security of the modified passphrase and how?

Any hint welcome.

Thank you for your help.

evo2 · 02-04-2021, 12:32 AM

Seven is hard, five less so. For example:

Quote:

Originally Posted by Stable Genius

Person woman man camera TV

Sorry, couldn't resist.

berndbausch · 02-04-2021, 01:50 AM

Quote:

Originally Posted by evo2

Person woman man camera TV

How did you know my password?

Seriously, five (see diceware) or seven unrelated words are fairly secure. When you change a few characters, security certainly doesn't suffer. If anything, it gets better.

Michael Uplawski · 02-04-2021, 06:15 AM

XKCD about password-strength:
https://xkcd.com/936/

ntubski · 02-04-2021, 07:47 AM

Quote:

Originally Posted by rblampain

The letters of the word "michael" having been used to add 1 letter to each word, the extra thing to remember would only be how each of the 7 words have been modified.
Although there could be some sort of predictability and loss of entropy in such practice, I can not see how.

My question: would such modification of the words affect negatively the security of the modified passphrase and how?

If the first passphrase is leaked, then it would be easier to discover the second one (or vice versa).

boughtonp · 02-04-2021, 08:12 AM

Quote:

Originally Posted by rblampain

My question: would such modification of the words affect negatively the security of the modified passphrase and how?

A passphrase made out of non-dictionary words is more secure than a passphrase made out of dictionary words.

So in most cases, your modification would be more secure, but (using a contrived example) it might not help, e.g: is at ho on to -> isp ate hot one tor - there are still five space-separated dictionary words.
I doubt that's a likely occurrence (especially with decent length words), but language is weird and there might be a few instances, so any process generating passcodes like that should verify the output with a strength checker to prevent accidentally insecure ones being created.

Also, it's important to note that in this context "dictionary" basically means any collection of "words", irrespective of Oxford/Webster/etc, though attackers will start with common/shorter dictionaries first (the smallest dictionary is the 62 alphanumeric characters).

And don't be afraid to still mix in symbols into your phrases - in unpredictable places - e.g. compare "that cat! wow!" to "that! cat^ wow".

Any information known or guessable about any passcode will reduce its security - if someone wants to attack you specifically, knowing the technique used will get them closer, as would knowing the seven-letter word you used (e.g. if you used the same word in multiple places, and one of those was insecure), but the time consuming part would still be trying combinations of seven words until they got lucky.

scasey · 02-04-2021, 06:38 PM

Another trick I’ve seen used is to replace some letters with numbers. 3 for e; 4 for a; etc. Also mixed case.

Michael Uplawski · 02-05-2021, 02:57 AM

I had once translated the Passphrase-FAQ into German and think it might still convey some valuable information, or inspiration, at least:
https://www.iusmentis.com/security/passphrasefaq/

////// · 02-05-2021, 04:23 AM

Quote:

Originally Posted by scasey

Another trick I’ve seen used is to replace some letters with numbers. 3 for e; 4 for a; etc

password crackers like hashcat have mode where it tries "1337 for leet" and "3 for e" and "4 for a" etc.

Code:

Table-attack

 This attack mode is also based on dictionaries. You can attack the following targets well:
 International characters
 Toggled-case words
 Leetspeek
 Fill “holes” in your dictionary
 The targets also can be combined, like:
 Toggled-case words + Leetspeak
 The table attack takes a configuration file, the "table"
 Inside the table, you do a simple X=Y binding per line
 Where X is a character that is to replace with Y
 NOTE: You can use X multiple times

^https://hashcat.net/events/p13/js-apg-htftl20.pdf