'Andyhave3cats' is a better password than 'Shehave3cats,' study finds

Carnegie Mellon University researchers find that certain grammar use can make passwords easy to crack, no matter the length or use of numbers, symbols

A password made up of a phrase or short sentence may be more secure than a carefully constructed long one, countering the recommendations of some security experts.

Researchers at Carnegie Mellon University's Institute for Software Research have found that long passwords that incorporate grammar -- good or bad -- are easier to crack than short passwords without structure.

The research team tested more than 1,400 passwords containing 16 or more characters against a grammar-aware password-cracking algorithm and found that grammatical structure can undermine security.

Ashwini Rao, a Carnegie Mellon software engineering doctoral student and the lead researcher on the project, said that while phrases and sentences can make passwords easier to remember, their grammatical structure significantly narrows the possible word combinations and sequences that hackers -- and their tools -- need to guess.

"We should not blindly rely on the number of words or characters in a password as a measure of its security," said Rao who is scheduled to present the findings of the study on Feb. 20 at the Association for Computing Machinery's Conference on Data and Application Security.

"I've seen password policies that say, 'Use five words,'" Rao said in a statement. "If four of those words are pronouns, they don't add much security."

The passwords used in the study were gleaned from a previously published research paper on password strengths that was presented at an IEEE security conference last year.

About 18% of the passwords had defined grammatical structures in a sequence of two or more dictionary words, Rao said.

Some of the passwords were simple, some contained letter substitutions (such as a "3" for "e") while others tacked on an extra symbol or number. Examples include "abiggerbetterpassword," "thereisnomorered0ts" and "longestpasswordever8."

Several of the passwords also contained other types of structures, such as email addresses, URLs and postal addresses.

The research team developed what it described as a proof-of-concept grammar-aware password-cracking tool to test how long it would take to crack such passwords. The tool used a dictionary for each part of speech and identified a set of grammatical sequences such as "determiner-adjective-noun" that might be used to create a password.

The research team discovered that the strength of a password often has little to do with its length. In fact, the team found that two passwords of identical lengths can differ in strength by orders of magnitude depending on the use grammar.

According to the researchers, the tool evaluates different parts of speech are be used to construct a grammatically correct sentence or phrase.

For instance, pronouns are used less than verbs, which are used less than adjectives which are in turn used less than nouns, the researchers noted in the paper. So a passphrase like "Andyhave3cats" will always be stronger than "Shehave3cats", because the use of a pronoun in the latter passphrase allows it to be broken with a fewer number of guesses, the team noted.

Neither the number of words or characters made much of a difference to password strength when grammar was involved. The researchers calculated that cracking a password like "Th3r3 can only b3 #1! " would take just 22 minutes while breaking a password using the words "Hammered asinine requirements" would take more than three and a half hours.

Generally, incorporating special symbols, letter substitutions and using uppercase and lowercase letters do not help as much as some experts say, Rao told Computerworld in an email.

"In our calculations we account for a constant amount of mangling or substitutions on [the] part of the user," she said.

Previous research has already documented well-known substitution patterns, she said. Common examples include capitalizing the first letter, substituting certain letters with numbers and adding a punctuation mark at the end, she said.

"Password strength depends on the underlying part of speech," Rao noted. "A dictionary for nouns is bigger than a dictionary for adjectives which is bigger than [a dictionary for] verbs. "

So a password with the underlying structure, pronoun-noun-verb-adjective-adverb, like "mypassw0rdis$uper str0ng" is much stronger than a password that has an existential-modal-verb-determiner-pronoun structure such as "Th3r3canonlyb3 #1!" she said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, send e-mail to jvijayan@computerworld.com or subscribe to Jaikumar's RSS feed .

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags Carnegie Mellon UniversityCybercrime and HackingsecurityMalware and Vulnerabilities

More about Carnegie Mellon University AustraliaIEEEMellonTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts