I am designing a web application for 10-13 year olds that will be used in schools. When the kids create their account, they will be asked to create a password.
I am struggling to come up with a way to guide the kids into inventing a good password. That is, I want an interactive step-by-step process that makes it more likely that they will pick something good. By 'good' I mean that it is strong against password guessing (many possible passwords) AND that it is memorable. We assume a strong password if it conforms to certain rules.
I have thought about the following, but I think they will just ignore it:
Print "Grab a book you like" Print "choose random chapter" Print "Take the first four words and replace all I's with 1, all e's with 3 and all s with $ and type in what you get" User types it in Print "Remember what you typed in, you will be asked for it in the future"
The replacement advice will be randomly generated and not be stored.
Maybe we could gamificate password creation? But how?
Note: The account itself isn't terribly important and the number of passwords, that an attacker can enter is limited to 3/second. However, two teachers, which we have consulted, think that such a process is a valuable learning opportunity, as textual passwords will be around for the foreseeable future.
We are stuck with text passwords because of an legacy system (Windows network) we have to be compatible with.