ykankaya / abbrase

password generation based on abbreviating phrases made with markov chains

#Abbrase#

Abbrase is an abbreviated passphrase generator. An abbrase is one of the passwords it produces. It generates a password and a phrase like "phyeigdolrejutt" and "physical eight dollars rejected utterly".

Try the web version.

Creating secure passwords is easy. Remembering them is hard. Pwgen makes them memorable though prounouncability. XKCD suggests using a series of random common words, but memorizing series of unrelated words can be difficult, and typing long phrases can be tedious.

Abbrase is an experiment in generating probable phrases using markov chains, and abbreviating each word to the first few letters. This strikes a balance between excessive password length and excessive mnemonic length. Passwords generated by Abbrase are as secure as a number with the same length. "122079103" and "toldulbal" (tolerably dull ball) are equally hard to attack.

The wordlist and bigram graph are generated with data from Google NGrams dataset, used under the Creative Commons Attribution 3.0 Unported License.

##Theory##

Language is the most information-dense thing people memorize. Brains don't operate on bits.

Pi recitation record-holders don't have thousands of digits in their minds. They map clusters of digits to far more mentally palatable words, memorizing a long story instead of a sequence of digits.

Memorizing a grammatically-sensible sentence fragment is easier than a sequence of randomly chosen words.

Picking a favorite phrase from the ones generated by Abbrase could make them very slightly easier to attack. A sophisticated attacker could check passwords that are likely to be picked before others. If the attacker can perfectly model which passwords you would prefer, this reduces the security of your password in a proportioanl amount to the number of passwords you selected it from -- if you picked from 32 passwords generated by abbrase, it makes your password 32x easier to attack (5 bits of security lost).

##Building##

git clone https://github.com/rmmh/abbrase.git
cd abbrase
make
./abbrase

The abbrase executable can optionally be supplied with length (a number), count (a number), and hook (a word).

##FAQ##

Q: Isn't using a phrase more secure than abbreviating it?

A: Not at all for phrases Abbrase generates. Displayed phrases are generated deterministically from the password, so they have no added security. Otherwise yes, 4 words have more security than 4 abbreviated words, but they're less convenient to type, and the added characters aren't as valuable as the first few characters.

##Sample output##

(don't actually use any of these passwords!)

Generating 32 passwords with 50 bits of entropy
Password           Phrase
---------------    --------------------
fibpsygotetemol    fibres psychology got eternal molecules
crohismacwrosiz    cross his machine wrong size
haswrigooalsarm    has written good also army
livfoctelduerow    living focus telescope due row
achtexmeaimiela    achieved text means imitation elaborate
poiatmengdocpea    point atmospheric engine doctor pearson
phosinwayladpha    photographs since way laden phagocytes
henraptopsawgif    henry rapidly top saw gifford
sednaravameaago    sed narrative available means agony
roomecgammedgoo    room mechanical game medical good
iniglouncmomkey    initial gloomy uncomfortable moment key
taswirhalpetgue    task wire hall peter guessed
nutdauliemesaba    nutrition daughter lie messenians abandoned
vanashairnumedi    van ashamed air number edited
groiniyarcampec    group initial yards came peculiarly
putmetvilburbor    put methodist village burnt borax
iniporadaneradh    initial portion adapted nerves adhere
liqpriproreapeo    liquid principle process reason people
nodnotmanpetedi    nodded not man peters edition
negfaslawelsbec    negative fashion law else because
nosyesroosoiask    nose yes room soissons asked
somextdiestumea    some extent die study means
vietumunrenapop    view tumultuous unrest enable popular
phyeigdolrejutt    physical eight dollars rejected utterly
somtoptexguibri    some top text guides bring
beyhabtoldulbal    beyond habit tolerably dull ball
timsirskyeldske    time sir sky elder sketch
bigownupoavolak    big own upon avon lake
phinowdirunalac    philosophy now direction unavoidable lack
darexppotegggat    dark experience potential eggs gathered
floalibadwhyour    flow alike bad why our
darmanfirpopnoi    dark man first popular noise