very true, using the sentence approach is *way* better than using your wife’s name or a birthday as a password. when i wrote the comment i was thinking about my first usage of a really safe password – it was a computer-generated one that i could not change. i hated it in the beginning, but even now, years after i used it for the last time i still remember it – and nobody could have ever gussed it.

as for the advantage of the non-random distributions of characters: when an attacker tries to guess a password he is likely to get a match with a sentence-password earlier than with a truly random one. because he can test for those passwords with more common characters first. suppose the attacker thinks “the password probably does not contain the five characters that are least likely the beginning of an english word”. that would save a substantial amount of time crunching through all possible combinations than including those 5. but i admit, for long passwords this will only be a theoretical advantage. because it really doesn’t matter whether the attacker needs one million or two million years to find the password

Great comment! You’re right that this type of password is created using a non-random process. However, despite the limitations you mentioned, password strings created using this method should be close to random from the perspective of someone (or a machine) trying to guess it.

As for each of your points:

- “first letter will always be capitalised”: probably, although you could choose not to
- “there will be few numbers”: compared to the number of letters, yes. However, even with just one number, a password guesser has to guess which number (0-9) and where it goes in the eight to nine word sentence. Not easy, as there are millions of combinations.
- “the (non-random!) distribution of first letters in English words can be exploited by passwords guessers”: Interesting, although I’m not sure how big an advantage this gives to guessers.

For those who would like to add more security, I would suggest adding one or more special characters to a password. So, if your password was made from “Debbie and Sally ate together in Beijing on Thursday”, you might turn it into “D@$8tiB0T”.

Something I’ve mentioned many times on this website is that there is no such thing as perfect security. Gregor, you may be right that the most secure passwords are created by machines, because they are completely random. It’s also true that the most secure passwords are upwards of 16 characters long. The trouble is, most people would prefer to use a crappy but easy to remember password than one that is secure but hard to remember. My thinking is that the average person (myself included) would be better off knowing the method to create a pretty darned secure password that they actually use than they would if I told them about the very best method that they never used.

What do you think?

I think a better solution is using some tool (https://www.grc.com/passwords.htm came up in a quick google search) to create a really random string and learning that (or a substring) by heart.