How secure are sentence passwords?

Question

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is 'This is my password.', or 'This is my <insert website here> password.' It seemed rather silly to memorize a group of random words instead of simply rather constructing a sentence, which is way easier on muscle memory. Is this easier to predict?

Answer 1

Let's do some math and study the language to see how this compares to the standard password requirement of 8 characters upper, lower, number and symbols.

Now we are going to be rigorous, so we assume that the attacker knows that you use a sentence as your password and is only trying to break it based on that information. He also knows that you do not use any spaces, capitalization or punctuation in the sentence. I am also intentionally ignoring grammar and syntax since it's too complicated and doesn't provide much insight to an attacker, apart from some words occur primarily at the beginning and or end of a sentence.

While there are a million or so words in the English language people don't use or know that many. The average person uses about 500 unique words in a day, and it is believed that an average person needs between 1500 and 2500 words in their vocabulary to communicate effectively for an extended period of time. Average person also knows about 15,000-20,000 words that they use infrequently.

So let's try those numbers with a 5 word pass-sentence:

Standard to compare is 95^8 = 6.6 x 10^15

500^5 = 3.1 x 10^13

1500^5 = 7.6 x 10^15

2500^5 = 9.8 x 10^16

From this we can conclude that using the expanded vocabulary of the average English speaker we can create a password that is as resilient to specialized attacks as the industry standard is to a brute-force. It would however be significantly more resilient to that same brute force, 26^16 = 4.4 x 10^22. (I used 16 as an average length of 5 words)

Take this all with the same mentality as a normal password. The password "P@55word" has all the features of a secure password but is totally insecure. The same would be true for a pass-sentence like "ilovemygirlfriendmelissa" especially with a little social media recon on the target.

I'm sure some security experts will disagree with this, but then again the security expert quoted in another answer on this page advocates writing down passwords, so I just assume they'll never agree like most experts.

Answer 2

Lately I've been doing the trend of using passwords that are sentences

We call them passphrases ;-)

at least on sites that have a reasonable maximum character length and allow spaces

All websites should allow that. Contact an admin and refuse to create an account if it doesn't. They should store the passwords in a fixed-length format (the technique is called "hashing") which makes that, for them, there is no difference between a 200 word long passphrase and a 3 character password. Both would be converted to a fixed-length piece of data by hashing. The fact that certain characters are disallowed indicates that it does matter what password you enter and, though it might still be fine, it stinks of bad password storage techniques.

the most basic variation is 'This is my password.', or 'This is my <insert website here> password.'

Okay, but please do remember that those are just that: "basic variations". They are not secure and should be used for useless, throwaway accounts only (like a temporary one to view an article, or to download something from Oracle, or you name it).

Passphrases work best when they are composed of random words. We, as humans, are bad at randomness and are unable to pick a random item from our entire vocabulary. It would be better to take a paper dictionary and roll dice to find a random page and a random word on that page.

If you don't have a dictionary handy, trying to make up random phrases with illogical constructions (e.g. "potato red red twitter mind") is a reasonable substitute.

You should be distrustful of online services offering to generate passwords for you. Even if they don't, they could technically store the password that it generated for you, or pick the "random" password from a list of only a few hundred possibilities (and yes, a few hundred is very few because computers will run through all those possibilities in a very short time).

It seemed rather silly to memorize a group of random words instead of simply rather constructing a sentence, which is way easier on muscle memory. Is this easier to predict?

It seems I've already answered this, but to reiterate: Yes, sentences are easier to predict than random words. The point of a password or passphrase is to be something only you know. Using phrases that make sense to us limits the number of possibilities, making it easier to guess. It's simply more probable that the word "red" follows after "the" and not after "potato" ("the red something" vs "potato the").

Answer 3

According to Bruce Schneier:

This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like "correcthorsebatterystaple" -- is no longer good advice. The password crackers are on to this trick.

The XKCD scheme is using long passwords that are composed from random words. What's true about sentences built from random words is doubly so about actual sentences.