Human Password Selection:
It is commonly known that
people typically pick weak (easy to crack) passwords. For example, Troy Hunt categorized
cracked passwords from the Sony
password breaches. Over two-thirds of the passwords fell into one of six
relatively simple categories:
Why do people
pick such simple passwords? One reason why people do not select random
passwords is that users are worried about forgetting their password. Another
reason is that users may not be aware of the attacks that could be mounted
against their passwords. In some cases users may use weak passwords to protect
accounts that are not important to them (e.g., ESPN). Another issue is that
humans have difficulty consciously generating random sequences.
One common issue
with popular password management schemes is that they instruct the user to make
up a random word or sentence, but do not tell the user how to do this. It
impossible to make any formal security guarantees without understanding the
entropy of a humanly generated random sequence. Suppose that you were not
worried about remembering your passwords, but that you did care about security.
In other words, suppose that you were simply trying to generate a random
sequence of letters and numbers without worrying about remembering it later.
Would that sequence of letters and numbers be truly random? Studies have shown that
humans have difficulty consciously generating random sequences of numbers. The ‘random’
sequences that people generated tended to follow predictable patterns that
would most likely not occur in a truly random sequence. Most people – when asked
to pick a random number between 1 and 20 – will select the number
This does not
rule out the possibility that human generated random sequence could provide a weak source of entropy. A
weak source of entropy could theoretically be used along with randomness-extractor
to produce a (shorter) truly random sequence of numbers although it is not
clear that a human could do this without computer help.