How to burn a password into your brain

Filed Under: Featured


A crook - who doesn't care that hacking somebody's account is illegal and immoral - will likely do well to just go ahead and plug in your cat's name.


But who can blame people for using - and, yikes, reusing! - passwords that are easy to remember?


But the numbers don't lie. Statistics show that we - well, people who aren't security savvy, at any rate - don't use strong passwords.

Enter Microsoft Research's Stuart Schechter and Princeton University's Joseph Bonneau, who on Friday presented an experiment they created to teach people to memorise very strong 56-bit random passwords through "spaced repetition" at the Symposium on Usable Privacy and Security.




Obviously, when you're talking about swapping out "password" or "123456", 56-bit represents a super-sized improvement.

The experiment's results are particularly enlightening from a wetware perspective, said Bonneau, a fellow at Princeton's Center for Information Technology Policy.


The researchers recruited hundreds of participants from Amazon's Mechanical Turk crowdsourcing platform and paid them to take a phony series of attention tests.








After three days, 88% still recalled the string or passphrase, with a minority - only 21% - reporting that they wrote their secret down.

"The words are branded into my brain", one subject told the researchers.

This technique obviously won't help people remember random, complex strings for each and every website they need to access.



It is, at the very least, another handy tool for security engineers' toolboxes, the researchers said, as well as representing hope for the human race in surviving the crunch between users and security mechanisms.

From the conclusion to their study:



Image of brain courtesy of Shutterstock.

, ,

You might like

14 Responses to How to burn a password into your brain

  1. Helen Wagen · 103 days ago

    So, what happens when you have to remember a new one after 90 days? And how do you tell it from the 48 others that you also have to remember for every website you visit or access system you use? The system is broken, folks! Stop pretending it can be fixed!

    • Bruce · 102 days ago

      as they say in the article - "for the passphrase they need to unlock a password manager"

  2. LOL "I respond to cash and spicy sites,.." good one.

  3. It is not wise to put many eggs in a basket. Password managers should be considered only for low-security jobs. Textual memory is only a small part of what we remember. We could consider to expand our password memory to include non-texts as well as texts.

    • Deramin · 102 days ago

      It's better to put all your eggs in one basket than it is to juggle them.

      It may mean that an accident has worse consequences, but that accident is comparatively less likely to happen. And when it does happen, it may be unpleasant enough to get one to seriously consider the strength of one's egg basket and the durability of one's eggs.

      Sometimes we have to accept what is possible as a first step to that which is good.

  4. Mike Townsend · 102 days ago


    Swap letters for numbers where appropriate. This is the first 39 words of a famous Wordsworth poem. DON'T use this one... we all know about it. Use one of your own poems. Even longer passwords are very easy this way... Enjoy your passwords and enrich your life at the same time.

  5. 56 bits is like 8 characters from a palette of 128 7-bit characters. Can't imagine why anyone would have trouble memorizing that.

    • nate · 101 days ago

      Including caps, my keyboard has 96 characters. In reality, my passwords don't even have 6 bits of entropy-- open and close bracket don't get a lot of play, for instance. The authors actually use 4 and two-thirds bits of entropy per character, suggesting a 26 character alphabet.

      I agree with what you might be suggesting though: that's not enough for a password manager (where if you're going to be attacked, it's offline, and it's a single point of failure). The actual point of this seems to be geared at institutions who want to pick passwords for their users because they feel their users are picking poor passwords.

      Worrisome, though, is the 6% failure rate. Consider what actual failure means when using a password manager: locked out of everything, including accounts to which the low security accounts will send recovery information. (And hopefully the high security accounts simply won't be recoverable-- otherwise, that's the weak link that needs addressing.) If you're going to have a single point of access, non-zero failure rates become very expensive.

  6. David Peaslee · 102 days ago

    I like to change a forgetful client’s pass word to “ICRMPWAD” or I Can’t Remember My Pass Word Again.

    Then I tell them to make up a sentence of who, or ware, or a job, or job duty’s, something that make sense to them, and wright it down if it is a longer description of something. I jokingly tell them to wright it down in their underwear. One day I had a user stop me all excited pulled up his shorts and showed me his password. Not much you can say but an “all right.” I think I laughed for over a week when I remembered him showing me.

    • 4caster · 102 days ago

      To "wright" is only done by playwrights, shipwrights and wheelwrights.

    • Thomas · 101 days ago

      Um, I'm not sure I'd take advice from someone who doesn't know how to spell the word "write". It could get a bit confusing righting doun words four wons pass word, unless you always misspell the same way every time.

      And please folks, don't write it down in your underwear, we don't want to see your junk when you're on a public computer or using your cell phone while walking down the street.

  7. Laurence Marks · 102 days ago

    56-bit password? Are you kidding? There are eight bits to a byte. A byte is the same as one character.

    Thus 56-bit passwords could be any of:

    Were you maybe thinking of 56-byte passwords?

    • Paul Ducklin · 102 days ago

      A 56-bit password is 8 *7-bit* bytes, and a byte may or may not be the same "one character," sometimes even in the same string! (Many a buffer has overflowed on the basis of that assumption.)

      That's 8 ASCII characters, or 10 base64 characters, at least to the closest whole number of characters with more than 56 bits' worth).

      So a 56-bit password could be 'password,' but it could also be '!@@W_~a4', and could have any of the 32 non-printable control characters in there, too.

  8. roy jones jr · 96 days ago

    I just wish people could stop being lazy. The article is telling you how to keep your own crap safe! (excuse my french). But I guess its human nature for people to only change after a major catastrophe happens to them.

Leave a Reply


You are commenting using your account. Log Out / Change )

Twitter picture


Facebook photo


Google+ photo


Connecting to %s

About the author
