Ok please reserve judgement on this. This is somewhere between a security and a UX question, plus it might be too broad.
I think my question can be summarised as:
What's the best way to engage a user to come up with four random words that they'd use for a password?
I'm thinking as a worst case scenario for improving the passwords for people who really aren't interested in security, but might be willing to listen to you long enough for a quick to understand suggestion.
What I imaging the scenario is that you're talking to someone and they mention that they've been having problems with finding a password for a service. At that point you might have a few seconds to grab their attention and give them some advice that would stick.
For example you're trying to get your parent / sibling / pointy haired boss to improve their password.
Or in general I'm trying to get the people who still would use 'password' or 'abcdef' to be interested enough in a password that they'd switch to a new default.
So the following would be ignored by the person:
- Password managers (at a stretch the in built browser ones)
- Discussions about upper / lower case / numbers / characters unless they are required for some particular website
It's worth remembering that the article is written in the context of people using passwords like 'password' and '123456' and 'qwerty'. For those who frequent security.stackexchange.com, sure, this method is far from great. If it reduces the number of people using '123456', though, I'm all for it.
I'm a big fan of the random four word plus spaces password concept popularised by XKCD - which is also recommended as a better solution in the accepted answer to the BBC question. What I really like about it is that it is trying to appeal to normal people, i.e. someone who would never visit security.SE or even know that such things exist.
I've tried before to tell such people about the XKCD concept and people still gloss over when I talk about that (it could just be just the way I tell it, but lets assume we're talking to someone who would laugh at my jokes).
In an ideal world I'd point them to something like http://passphra.se but again you can't get them to grip that concept easily and it doesn't work in a conversation scenario.
So the password suggestions you give would have to follow this format:
- all lower case
- whole words, connected to objects they can imagine
- The last four pet names they had. You could try and get them to use the most obsure ones, i.e. fish names instead of dog names or a mix of different animals to increase the search space of names - this needs more googling along the lines of "distribution of common pet names" e.g. this book page for how insecure it would be
- Four cousin's names. This is obviously fact checkable for someone really researching into them - especially if they're all publically linked in facebook. You could suggest alphabetical order to help them remember the order - this reduces the security but increases the memorability
- Four local slang words, the most obvious I can think of is cockney rhyming slang, this might get people to choose words that are more random than they'd choose otherwise whilst at the same time being more fun/interesting.
I'm not saying these are perfect or would stop anyone getting into Edward Snowden's twitter account - but they should be a big improvement on 'abcdef'.
As a final point I'd imagine you might be able to append whatever extra characters you're required to use to this 'securish' base to get around stupid password rules that sites have.