http://combo-pw.tech

https://news.ycombinator.com/item?id=19290613

Now I struggle to find out how many more possible passwords a "Combo Password" has compared to a normal password with the same number of key presses.

There are more. I can show this, but not calculate it properly since I apparently suck at combinatorics.

Keys: {0,1} KeyPresses: 3

A normal password has 2^3 = 8 different combinations: {000,001,010,011,100,101,110,111}

A combo password (e.g. "01,0" - the comma seperates the combinations) also has those 8 combinations: {"0,0,0","0,0,1","0,1,0","0,1,1","1,0,0","1,0,1","1,1,0","1,1,1"}

But there are more possibilities: {"01,0", "01,1", "10,0", "10,1", "0,01", "0,10","1,01","1,10"}

• I do not yet follow. In your link it would appear as though "0,01" should be considered the same as "0,10" since the collection of digits in the second grouping are the same albeit in a different order. – JMoravitz Mar 3 at 13:48
• For the remainder of this comment, I'll refer to collections of digits separated by commas as blocks, e.g. in 1,23,456 we have the block 1, the block 23, and the block 456. Please clarify the following: How many commas are allowed in total? If we rearrange the numbers inside of a block does that count as different? (is 1,23,456 the same as 1,32,465?) If we rearrange blocks themselves does that count as different? (is 1,23,456 the same as 456,1,23?) Can a character be repeated inside of a block? (is 1,11 an allowable password?) Can blocks repeat? (is 1,23,23 an allowable password?) – JMoravitz Mar 3 at 13:49
• There are two different behaviours of the password check, toggled with the checkSequence flag via the checkbox. When false "0,01" = "0,10", when true "0,01" != "0,10". – Falk Mar 3 at 13:54
• Assuming then order of blocks matters, order within blocks matter, any number of commas may be used, characters may be repeated inside of a block, and blocks can repeat with $k$ characters available and a "password length" (ignoring commas) of $n$ you would have $k^n\times 2^{n-1}$ possible passwords. That shouldn't be surprising though if you interpret the password as a length $2n-1$ string where every even position is either filled by the empty character or by the comma. If digits may not repeat within a block then things get messy. – JMoravitz Mar 3 at 14:00
• As for the "usefulness" of this "new password style" I am skeptical. Not only is it more frustrating to use and harder to implement than traditional passwords, it really isn't that different than just including the comma characters as a part of a traditional password in the first place, which if you were to have the ability to do so you could have used a character other than the comma (or empty character) in its place to give far more possibilities. It doesn't really aid in the memorization of passwords either as memorizing blocks works just as well in traditional passwords. – JMoravitz Mar 3 at 14:13