Randomness

Password security essentially revolves around one basic strategy: creating a password that no one else can predict (or guess) within a reasonable amount of time, and then changing it regularly to continually make it difficult to predict.

It is not easy to intentionally be unpredictable. Human beings have to struggle to be random and sometimes in the process end up being even more predictable. Randomness the most important aspect of password security is what we struggle with the most.

Part of the problem is that we generally have a poor concept of randomness it is difficult to define. For example, when we gamble on a certain slot machine for a period of time with no luck, we tend to move on to another, perhaps luckier, machine. When someone scores a huge jackpot on a machine, they believe that it is now spent and move on to another machine. Gamblers talk so much about winning streaks, being hot or cold, and payout averages that they are almost superstitious about randomness. However, the flaw in this is that random has no preference and no memory. Randomness does not track statistics and is completely unpredictable. Sure, if you track enough slot machines over a long enough period of time they will pay off, but a slot machine could get three jackpots in a row or never hit a jackpot. Randomness does not know the difference there is no trend or bias.