> Bonneau suggests that people chose a randomly selected number at least nine digits long
I've been working on a program that generates passwords that are (1) English-sounding by nonsense words of a specified length, and (2) where the letters alternate hands when typed.
So (1) makes a password that's pronounceable and therefore easier to remember semantically, while (2) makes it quick-to-type and therefore easier to "remember" via muscle memory. This should make frequently changing one's passwords less painful.
Is there any reason this is a bad idea? Obviously it's not as secure compared to a purely random string of the same length, but my thought is it would encourage people to change their passwords more often since there'd be less friction involved in doing so.
EDIT: I should note that a password manager is a far better idea. But for places where that's not practical (OS login, or the password to your password database), I feel this might be useful.
EDIT ALSO: While I like the XKCD idea in theory, I think it sucks in practice. You're typing four words without the benefit of screen feedback, so typos are more likely, plus it takes a relatively long time to type them.
Comments
> Bonneau suggests that people chose a randomly selected number at least nine digits long
I've been working on a program that generates passwords that are (1) English-sounding by nonsense words of a specified length, and (2) where the letters alternate hands when typed.
So (1) makes a password that's pronounceable and therefore easier to remember semantically, while (2) makes it quick-to-type and therefore easier to "remember" via muscle memory. This should make frequently changing one's passwords less painful.
Is there any reason this is a bad idea? Obviously it's not as secure compared to a purely random string of the same length, but my thought is it would encourage people to change their passwords more often since there'd be less friction involved in doing so.
EDIT: I should note that a password manager is a far better idea. But for places where that's not practical (OS login, or the password to your password database), I feel this might be useful.
EDIT ALSO: While I like the XKCD idea in theory, I think it sucks in practice. You're typing four words without the benefit of screen feedback, so typos are more likely, plus it takes a relatively long time to type them.