Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I make great passwords which I remember in my fingers when I'm on a laptop keyboard. But when I turn to mobile devices, I lose my muscle memory on the soft keyboard. To overcome this problem, I store passwords on various cloud services, which isn't the best option in terms of security.

Everywhere it's possible I use third party identification issuer such as Google, Facebook, Twitter and OpenID. Superb UX for mobile devices since it narrows the number of username/password to remember.

But still I have trouble using my old passwords since I don't remember them, and if I do - I need to switch keyboard layout on every other keystroke. So there's my problem. What strategy should I use to make easy remembered, easy typed and secure password for mobile devices?

enter image description here enter image description here enter image description here

share|improve this question
My response is to never use a phone without a hardware keyboard. Which is a testament to how bad the experience is by default on a standard phone keyboard. –  Racheet Jan 6 at 13:15
Easily-typed and secure are probably divergent goals? –  RedSirius Jan 6 at 13:41
Anyway, my strategy for passwords which I must remember are to have 3 'tiers' of passwords based on a mixture of trust and login frequency. Top tier (e.g. email, facebook, etc) get a unique password. 2nd tier share a common password strategy which still results in a unique password for each site. 3rd tier gets a common throwaway password. –  RedSirius Jan 6 at 13:46
add comment

2 Answers

up vote 8 down vote accepted

You could use an alphabetic passphrase. Passphrases, such as "correcthorsebatterystaple" are strong passwords, easy to remember, and in this case, easy to type on a virtual keyboard without switching to the alternate keyboards.

enter image description here

share|improve this answer
Passphrase is my answer too, but the way I understood it, it contains spaces between words. 'correcthorsebatterystaple' would in that case be a password. If I remember correctly it is suggested in a strip about setting up passwords? –  Paul Jan 6 at 14:52
Spaces don't really matter (they are just another type of character, after all). The example I gave is from an XKCD comic (it's linked). –  Joshua Barron Jan 6 at 15:05
The reason passphrases are more secure is because they're not going to be found in a dictionary. This protects you from dictionary attacks and rainbow table lookups if the system has been compromised. –  cimmanon Jan 6 at 15:40
add comment

This reminds me of the password vs. passphrase discussion, some two years ago. It was said that passwords are difficult to remember and people therefor used the same password or just a few passwords for all their accounts. They said passphrases were easier to remember and harder to guess. A passphrase could be something like: 'Curt Cobain died at age 27'. A passphrase could in this case be easier to type and according to some people even be more secure.
I personally don't believe a passphrase is more reliable then passwords. I personally think we should move beyond passwords, effectively bypassing your conundrum.

Finger print
There is the classic finger print scan. It is however, not that secure. Word is even the iphone 5 finger print scan has been hacked. But then again, passwords aren't complete secure either. Next to that, devices need to have such a scanner implemented else you can't log in.

Facial recognition
Facial recognition is also an option. How secure this is I don't really know, I've heard the facial recognition lock of Android devices can be hacked just by holding up a picture of the right person. I do know this method is not ideal in every situation. There could be inefficient lighting or some other interference and blocking your face with your phone in order to unlock it could be dangerous in multiple situations. And just like finger print scans, facial recognition also requires certain hardware to be present (I'm talking about a camera ofcourse).

Voice recognition
Voice recognition is pretty much the same as finger print scans and facial recognition. Hardware is required and with some trouble it can be hacked.

Personal anekdote
A solution I came across quite recently was about answering a specific detail about an anekdote. When creating an account you have to enter one or several personal stories or anekdotes. When trying to log in the computer asks for a specific detail, like 'what happened during Thanksgiving 2003', and you have to answer, like 'Auntie Muriel lost her watch inside the turkey'. This is somewhat the same as a passphrase, but is more cumbersome to set up. The computer could however ask you for something different every time you log in and according to some, remembering those anekdotes will put you in a good mood.

Keystroke dynamics
This solution I like the most, but it seems quite difficult and not applicable for every application. Keystrokes dynamics is a technique where the computer analyses and recognises the users typing pattern. Research says this method was correct in 95,5% of all cases. Seems quite foolproof. Something like recognising handwriting. But, it seems to me you already have to type stuff somewhere in order for the computer to analyse it. And I don't know many keystrokes you'll have to make for the computer to recognise you.

Email authentication The last solution (I came by and can remember) is email authentication. The user enters his or her username or emailaddress after which the computer will send an email with an unique link. The user only has to remember one password, that of it's email client. The problem I have with this solution however, next to the fact I think it's cumbersome to open your emailclient in order to log in to the application or website you just opened, is: what if I lose my phone and some bad person finds it. My emailclient is not locked on my phone. They could read every email I receive.

So in short: the answer for a short term solution is 'passphrase' (perhaps, since I'm not quite convinced), the answer for long term solution is 'go beyond passwords'.

share|improve this answer
Passphrases are undeniably more secure than shorter passwords (they have much higher entropy). –  Joshua Barron Jan 6 at 15:07
Anyone who's ever watched pretty much any movie ever should already know that things like fingerprint scans are insecure. You just knock out the bad guy, put his hand on the scanner and you're in! –  cimmanon Jan 6 at 15:44
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.