They generate a random 60-bit number and map it to a poem, so it has exactly 60 bits of entropy. If you want to double it, memorize four lines instead of two.
Their passwords do have 60 bits of real entropy, but the estimates in the article aren't based on how long it would take to brute-force a 60-bit password - according to the paper, that would only take 11.3 years on a single (2011-era) GPU, rather less than the 5 million they told the Washington Post. At a guess, they're counting the entire 79-bit poem pool they're culling the actual valid passwords from, on the assumption an attacker will have to test all of them. (The algorithm maps those 60 bits onto one-million-poem wide slices of the pool, and returns only the one that looks most like valid English.)
You can also memorize a sentence or a paragraph from a book that you love and own (which also can be used if you ever forget, or need to share the password with anyone)).
If you've read the paper you'll see they have an optimization process that produces passphrases which are more easily memorized, this process allows you to build a specific dictionary, so you can build a hash table which will include all the hashes of all of the possible passwords that can be created by this method.
The password cracking numbers they reference in their paper refers to bruteforcing LM passwords using a GPU by randomly generating characters, using a rainbow table increases that number by several orders of magnitude, using masks and dictionary attacks also increases that number considerably.
Other assumptions like knowing the maximum password length supported by the authentication mechanism you are attacking can make this even more trivial to attack because while their average input is 52 or so chars per poem if you are attacking a system that does not allow more than 36 chars for example you pretty much limiting the password entropy to a few thousands of passwords in their case.
This was an interesting read but it lacks quite a bit of stuff to work in the real world, just like the fact that a 2048 bit RSA keys are in theory almost impossible to factor doesn't mean you can't do that if you can assume allot of things about the key, when you can employ work reducers you start shedding quite a bit of that on-paper entropy.
The optimization attempts to pick the most easily-memorized poem out of a million possible poems for each 60-bit number. It doesn't reduce the entropy below 60 bits, it starts at higher entropy and reduces it to 60.
Obviously if the authentication doesn't allow the password to be entered then the scheme won't work. That's true of any password scheme.
Comments
They generate a random 60-bit number and map it to a poem, so it has exactly 60 bits of entropy. If you want to double it, memorize four lines instead of two.
Paper: http://www.isi.edu/natural-language/mt/memorize-random-60.pd...
Their passwords do have 60 bits of real entropy, but the estimates in the article aren't based on how long it would take to brute-force a 60-bit password - according to the paper, that would only take 11.3 years on a single (2011-era) GPU, rather less than the 5 million they told the Washington Post. At a guess, they're counting the entire 79-bit poem pool they're culling the actual valid passwords from, on the assumption an attacker will have to test all of them. (The algorithm maps those 60 bits onto one-million-poem wide slices of the pool, and returns only the one that looks most like valid English.)
Hence my suggestion to memorize two such passwords.
You can also memorize a sentence or a paragraph from a book that you love and own (which also can be used if you ever forget, or need to share the password with anyone)).
Better pick an obscure book, I've read about cracking programs with books in their dictionaries.
If you've read the paper you'll see they have an optimization process that produces passphrases which are more easily memorized, this process allows you to build a specific dictionary, so you can build a hash table which will include all the hashes of all of the possible passwords that can be created by this method.
The password cracking numbers they reference in their paper refers to bruteforcing LM passwords using a GPU by randomly generating characters, using a rainbow table increases that number by several orders of magnitude, using masks and dictionary attacks also increases that number considerably.
Other assumptions like knowing the maximum password length supported by the authentication mechanism you are attacking can make this even more trivial to attack because while their average input is 52 or so chars per poem if you are attacking a system that does not allow more than 36 chars for example you pretty much limiting the password entropy to a few thousands of passwords in their case.
This was an interesting read but it lacks quite a bit of stuff to work in the real world, just like the fact that a 2048 bit RSA keys are in theory almost impossible to factor doesn't mean you can't do that if you can assume allot of things about the key, when you can employ work reducers you start shedding quite a bit of that on-paper entropy.
The optimization attempts to pick the most easily-memorized poem out of a million possible poems for each 60-bit number. It doesn't reduce the entropy below 60 bits, it starts at higher entropy and reduces it to 60.
Obviously if the authentication doesn't allow the password to be entered then the scheme won't work. That's true of any password scheme.