Cryptographic Cognition

An attacker is not the only threat a password has to survive. A second, threat is self-lockout. A password or system so complex the user forgets it. A password assembled from some external reference, a phrase, a pattern, or a source that is later lost or destroyed, taking the password with it. A password that is theoretically perfect but practically irrecoverable has still failed. Nothing was stolen. Nothing was breached. The information is simply gone, encrypted into oblivion by the very credential that was meant to protect it.

Many of the ideas explored throughout this paper rely on remembering a simple concept rather than the password itself. A password may be derived from a document, a phrase, an image, a piece of source code, or some other reference. This introduces an important tradeoff.

Private references are generally more difficult for an attacker to discover because they exist only within the user's own environment. The disadvantage is that they must also be preserved. If the final copy is lost, the password may be lost with it.

Public references have the opposite properties. They are far easier to recover because they exist independently of the user. If the reference is forgotten or misplaced, it can usually be obtained again from reality. However, this also makes it more knowable to an attacker, increasing the likelihood that it eventually becomes part of a sufficiently sophisticated attack corpus.

Neither approach is universally better. One prioritizes obscurity, the other recoverability. Throughout this paper I treat them as two ends of the same design spectrum.

Throughout this paper I assume the password being discussed is itself a foundational credential, such as the master password to a password manager or the credential protecting a user's most important encrypted data.

For that reason, suggestions such as storing the reference in an email account, cloud storage, or another password-protected service do not solve the problem. Accessing those services already depends upon credentials that ultimately derive from the very password we are attempting to remember. The chain must terminate somewhere. The challenge explored here is discovering a password that can stand at the root of that chain without depending upon another protected account for its own recovery.

This thought experiment also assumes the password should survive the loss of the user's local environment. I intentionally do not rely upon physical reminders such as notebooks, printed papers, books on a shelf, labels, safes, safety deposit boxes, or any other object whose survival depends upon continued physical access.

Instead, I assume extreme but plausible failures: regional displacement, fire, flood, tornado, earthquake, electromagnetic disruption, theft, or any other event capable of separating a person from their possessions. Any service provider is considered temporary. The password should ideally remain recoverable through memory, or through references that exist independently of the user's personal environment.

Entropy is commonly expressed in bits by using this formula:

Entropy (bits) = log₂(total possible passwords)

Every additional entropy bit doubles the number of passwords an attacker must search.

From here the subject branches into several related ideas about entropy. Those distinctions are important academically, but they are not necessary for the purpose of this paper. What matters is understanding that there is a difference between the entropy of a password space and the entropy implied by the process that generated a particular password.

Imagine a perfectly random password generator producing two eight-character passwords:

R7@k!2Qm

AAAAAAAA

Both passwords came from exactly the same random process. The generator itself is expressing maximum entropy because no human preference, memory, or heuristic influenced the result. The second password simply happened to be an extremely unlikely outcome of that random process.

I will briefly step outside established terminology and coin my own term: Entropic Purity.

This represents a real but epistemically inaccessible grading of how closely an output appears to resemble the product of perfect randomness.

For example, imagine a generator producing two passwords:

Q7@mL2#vX9!c

tifalockhart

The prior, tifalockhart, appears to exhibit obvious human structure despite arriving there purely by chance. I would therefore describe tifalockhart as having lower Entropic Purity, even though the entropy of the generating process was identical.

This is an attempt to describe that the entropy of the generative process cannot be inferred from the output alone. I find this to be one of the more bizarre, perhaps even paradoxical, aspects of cryptography.

An offline attack means the attacker has already obtained the password hash (or encrypted data) and can test guesses locally without interacting with a server, there are no ways to throttle it and the attacker can try as rapidly as possible. The cost of each attempt is simply the time required to compute the password verification algorithm. Depending on how the password is stored, this may be extremely fast or intentionally slowed using algorithms designed to resist brute-force attacks.

This would be equivalent to attacking an encrypted ZIP archive, password manager database, or any other encrypted file that can be copied and tested locally.

An online attack is interacting with a designed access point like a login form on a website. The site itself has the ability to throttle your attempts as much as it wants, introduce time delays, make you do captchas, or even ban your IP and other countermeasures if you do suspicious things.

The crack times quoted throughout this paper are only rough illustrations. There is no single answer to how long a brute-force attack takes because it depends on how much computing power an attacker is willing to devote to the search. One computer may take years, while a thousand similar computers could complete the same search dramatically faster by dividing the work between them. The examples in this paper should therefore be understood as representing a modern, high-performance attack rather than a fixed or universal measure of time. Given enough motivation, budget, and hardware, these times can be reduced substantially.

The times below are rough estimates assuming an offline attack using a general idea of what a modern system computing these tasks would be able to do.

Ideas that humans remember often are anchored by what I call an Idea Seed: a small concept so deeply emblazoned in memory that it can reliably regenerate a much larger chain of thought.

For example, my own Idea Seed is Tifa Lockhart. She's my ultimate waifu, so she's easy for me to remember, and only I know that.

You'll notice I use her name throughout various examples in this paper. The seed itself is not the password; it is simply something I know I can never forget. From that seed I can build increasingly complex ideas through transformations and associations. Not every password construction requires an explicit seed, but I believe human memory naturally works this way. Even complex memories often reduce to a handful of simple anchors from which the rest can be reconstructed.

An Idea is not limited to plain values like names or dates. It can also consist of a transform, something closer to an operator than a value, similar in spirit to arithmetic operations like addition or multiplication. A transform takes an input and systematically turns it into something else.

As an example, imagine a calculator that takes a string, converts each letter into a corresponding number, and then exponentiates a running total by each successive letter's numeric value. Typing in a name like TIFA LOCKHART through this process produces an enormous number, far larger than anything a person could generate by typing digits directly. That process is a transform, and the transform itself becomes part of the Idea. Now I can remember an unfathomably large number. This matters because a person doesn't have to remember the output; they only have to remember the transform and its input.

An Idea can also act as a placeholder for a large body of content the person doesn't actually memorize, only references. For example, someone could set their password to the full copy-pasted text of their 2011 tax return PDF. No one could recite that text from memory, but they could easily remember "my 2011 tax return PDF, pasted in full" as the instruction for producing it.

These pieces can also be chained. A password could be defined as: take the full text of my 2011 tax return, apply the alphanumeric string exponentializer to it, then reverse the resulting string. Each step is a transform, and the chain of transforms—not any specific value—is what the person actually holds in memory.

Keyspace is the complete set of every password a system can technically accept. It is determined entirely by the rules of the password field: the allowed characters, the minimum and maximum length, and any other input restrictions. Keyspace makes no assumptions about what a human would actually choose. It simply represents every value that could exist.

Search space is the total set of password candidates an attacker actually evaluates during a specific attack. Unlike keyspace, which is fixed by the system, search space depends entirely on the attack strategy. A brute force attack attempts to make its search space equal to the entire keyspace. A heuristic attack deliberately searches only selected regions of that keyspace where human-generated passwords are believed to be concentrated.

Hypothesis space is the full range of guesses an attacker might reasonably try, based on patterns, rules, and human behavior — as opposed to keyspace, which is the full range of values something could technically be. In terms of ideas an attacker could pursue, hypothesis space is effectively infinite; there's no limit to the number of theories or angles someone could chase. Keyspace, by contrast, is often small. Take a single digit password: a number from 0 to 9. An attacker could dream up endless theories about what that number "means" — birthdays, lucky numbers, favorite jerseys — but the number of possible answers is exactly ten. Chasing clever theories about what the number represents is almost always a worse strategy than just trying all ten directly.

Idea space is the counterpart to hypothesis space, seen from the other side of the password: it's the boundless range of ways a person can dream up a secret in the first place — a memory, a transform, a reference, a chain of both. Where hypothesis space is what an attacker searches, idea space is what a creator draws from. And unlike hypothesis space, which collapses under cost the moment it gets expensive to explore, idea space has no such ceiling. A person can always go one layer more abstract, one more transform deep, one more obscure reference — there's no threshold where generating a new idea becomes "not worth it" the way there is for guessing one.

The expense of a heuristic attack is the total number of attempts required to generate every permutation of every hypothesis the attacker chooses to execute. Every hypothesis contributes some number of candidate passwords, and the total expense is simply the sum of all of those attempts.

At some point, the cumulative expense of a hypothesis-driven attack exceeds the total number of attempts required to brute force the remaining keyspace. I call this the Threshold.

Past this point, heuristics cease to provide any computational advantage over exhaustive search. An attacker may still continue generating hypotheses, but from a computational perspective they have already spent more effort than brute force would have required.

Beyond the Threshold still exists an effectively infinite Idea Space capable of expressing passwords within the finite keyspace. Human creativity does not terminate simply because brute force has become the cheaper strategy. There always remain further ideas, transformations, abstractions, and constructions capable of producing passwords that lie somewhere within the same finite password space.

This Threshold resembles the goal of guessing-number research, which seeks to identify the point at which heuristic attacks cease being cheaper than exhaustive search. I arrive at the same destination from a different direction: by considering the relationship between a finite keyspace and an effectively unbounded Idea Space.

The exact location of this threshold could, in principle, be determined only in hindsight, once every hypothesis had either been executed or discarded. In that sense, an all-knowing observer—call it God, for lack of a better term—could assign the exact Threshold for any password against any attack.

As with many qualities proposed throughout this paper, I consider this threshold to be objectively real but epistemically inaccessible.

I will refer to this quality as Algorithmic Expressibility: the degree to which a password construction can be cleanly expressed as an algorithm.

This is not simply a question of whether a rule can exist. Given enough effort, any specific password could be described by an exact rule that generates only that password. Such a rule is meaningless because it solves nothing beyond the password it already knows.

Instead, useful rules are those that generate many plausible passwords while requiring relatively few total attempts. A good rule compresses a large amount of human behaviour into a compact algorithm.

Brute force is the simplest rule imaginable. It generates every possible password, but it also generates the entire keyspace, making it computationally expensive. Heuristic rules exist because they attempt to express a much smaller collection of likely passwords for far fewer attempts.

As additional variables are introduced, however, a rule gradually loses its advantage. Eventually it becomes surrounded by so many equally plausible neighbouring rules that no single rule can reasonably be preferred. At that point the attack begins to resemble brute force in another form: not by exhausting the keyspace directly, but by exhausting an ever-growing space of possible algorithms.

This suggests there exists a practical boundary beyond which some ideas are simply no longer worth expressing as attack rules. They may still be perfectly describable, but the computational cost of expressing and executing the rule outweighs any advantage it provides over brute force.

Many constructions within Idea Space appear, at first glance, to dramatically reduce the search space. They seem to offer a compact algorithm capable of expressing a vast family of passwords.

Yet repeated examination often reveals an interesting pattern. As additional variables are introduced to make the rule expressive enough to capture increasingly complex ideas, the rule itself begins to unfold into a search space approaching the size of the password space it was intended to replace. The apparent compression gradually disappears.

This reminds me of mathematical objects that contain smaller versions of themselves, or the thought experiment of a library containing every possible book, where removing a page still leaves another library containing every possible remaining book. The space appears to fold back into itself.

I suspect many heuristic attacks possess this property. A hypothesis may initially appear concise and powerful, but once all of the parameters, transforms, exceptions, and neighbouring possibilities are accounted for, expressing the hypothesis begins to require exploring a space comparable to the one it was attempting to avoid. At that point, the distinction between searching hypotheses and searching the password space itself begins to blur.

The word password repeated 230 times.

If this hypothesis were guessed and prioritized early, the broader rule would provide only around 24.5–26 bits of security, which is extremely weak. This figure assumes a dictionary of roughly 100,000–300,000 words, with every word tested at repetition counts from one through 230. Once programmed, the NSA could exhaust that entire rule in a fraction of a seconds.

A more obscure word might provide slightly more practical protection because some attacks use smaller dictionaries, but it would not meaningfully strengthen the rule against an attacker willing to test a complete one.

Within the fictional 100,000-year timeframe, I would speculate that this rule would be attempted within days. Is there a repetition count so extreme that it would fall beyond the range anyone thought worth testing. (I capped the entry exactly at 230 attempts but what if we did 2300).

Exploring the rule more fully would also require variations such as leetspeak, capitalization, camel case, common substitutions, misspellings, separators, and other transformations. These would greatly expand the number of attempts, although the basic repeated-word rule would remain cheap to test.

The inclusion of even a single wildcard could greatly improve the password's chances by creating uncertainty beyond the repetition rule itself. An unusual misspelling could do the same if it were absent from both the attacker's extended dictionary and its collection of common misspellings. If the altered word were already present in either set, however, the repeated-word rule would remain trivial to test.

The number "1" 320 times with the 270th spot switch to "^".

The hypothesis required to catch this would be: repeat any character up to 320 times and replace one occurrence with a different character from the same set. Using the roughly 94 printable characters found on a standard keyboard, the complete rule provides around 29 bits of entropy. Expanding the search to roughly 100,000 Unicode characters, including large Chinese, Japanese, and Korean character sets, raises it to around 49 bits. Searching the entire Unicode code-point range would raise it to roughly 56 bits.

Even the broadest version could be exhausted in hours by the fictional NSA once the rule had been programmed, making this a reasonably attractive rule to include.

My hunch is that this password would be discovered within the first year. It would need several additional twists to have a serious chance of surviving.

This version suggests a much more expansive character set, but even searching the entire Unicode range would remain feasible within hours once the rule was known.

A key insight is that the length and wildcard position contribute relatively little to the rule's complexity. Each adds only about eight bits at a maximum of 320 possibilities. Most of the entropy comes from selecting the repeated character and the replacement character. A much shorter version of the password would therefore offer nearly the same protection.

A popular Beatles lyric divided into two halves. The first half is repeated nine times and suffixed with !, while the second half is repeated eleven times and suffixed with #.

This is where I begin to lose confidence in my intuition.

Unlike the previous examples, the attacker is no longer searching for a simple structural rule. The password is built from several independent human decisions: selecting a particular lyric, deciding where to divide it, repeating each half a different number of times, choosing punctuation to separate the repetitions, and finally concatenating the result into a single password.

None of these decisions are individually difficult to search once they have been hypothesized. The challenge is deciding that this family of constructions deserves to be searched at all. A rule capable of finding this password would likely need to explore not only song lyrics, but quotations, poems, books, sayings, nursery rhymes, and countless other forms of remembered language. It would then need to consider arbitrary split points, unequal repetition counts, punctuation, capitalization, substitutions, and other transformations. Each new possibility is inexpensive to execute, yet collectively they create an enormous number of plausible hypotheses.

My speculation is that this is approaching the point where idea space begins to dominate classical search space. I can easily imagine an attacker writing a rule that would discover this password, yet I can also imagine an effectively endless supply of similarly plausible human constructions competing for attention.

Would the fictional NSA eventually discover this rule within one hundred thousand years? I genuinely do not know. My intuition places it somewhere near the boundary where the engineering effort required to invent and prioritize the hypothesis begins to outweigh the cost of executing it. If forced to assign a probability, I would estimate roughly a twenty-five percent chance that this password is ever discovered.

My intuition is that a single additional wildcard would likely push this beyond the point of discovery, if it has not already crossed that threshold.

This section explores using entire public documents as passwords. Candidates might include the complete text of the MIT License, the screenplay of The Notebook, a famous speech, a recipe from a cookbook, a software source file, or any other publicly available document reproduced verbatim.

What appeals to me about this approach is not necessarily its strength, but its recoverability. While such documents are far too large to memorize, they are also difficult to permanently lose. As long as the simple idea is remembered, the original document can usually be obtained again from reality.

Once the hypothesis is known, the rule itself is trivial: hash every document in a corpus and compare the result. The interesting question is whether such a corpus would ever become large enough. Should it include books, recipes, speeches, poems, song lyrics, software source code, legal documents, academic papers, technical standards, patents, or everything ever published? While the most famous documents might justify inclusion, I suspect a vast amount of human writing would never become worthwhile to search.

In my fictional scenario, I would estimate roughly a 95% chance that the complete MIT License would be discovered within one hundred thousand years. By contrast, I would place the screenplay of The Notebook at roughly 30%, simply because I am far less confident that a corpus of film scripts would ever become sufficiently complete to justify the effort. As the documents become increasingly obscure, my intuition is that the probability rapidly approaches zero.

This section explores using an entire private document as a password. As an example, imagine using the complete text extracted verbatim from my 2011 tax return PDF.

Like public documents, this approach is attractive because it is easy to remember. I do not need to memorize the document itself, only the idea behind it. Unlike a public document, however, I am now responsible for preserving the source. If every copy is lost, then the password is lost forever. It cannot simply be obtained again from reality.

The more interesting question is whether an attacker would ever search this family of passwords. Would a sufficiently sophisticated attack begin enumerating every text file on a compromised computer and attempting each verbatim? If so, would it stop at plain text, or continue into PDFs, source code, spreadsheets, email archives, notes, chat logs, configuration files, and every other document it could extract? Would it then begin hashing binary files directly? Would it attempt to interpret images as raw pixel data, generated text through OCR, or metadata? Would it execute scripts and hash their output? Would it recursively transform every file into every plausible textual representation before testing it?

I genuinely have no intuition where such a search would end. Each individual hypothesis appears reasonable in isolation, yet together they form an almost boundless collection of possible representations. My speculation is that many transforms easy to program program would likely be attempted within one hundred thousand years, even into relatively obtuse trials but the complete space would never be exhausted. To survive I'd say it likely would need some exotic twist, or alteration, simply pruning, splicing, or cropping might not be enough.

A hand-authored piece of prose of sufficient length.

This example explores using original prose as a password. A love letter is simply one illustration of the broader category, which could equally include a short story, an essay, a journal entry, a speech, or any other piece of writing authored by the user. At this length the password is approaching the practical limits of human memory, although I believe it could still be memorized with modest effort through repetition.

This thought experiment asks a different question from the previous examples. Rather than searching a finite dictionary or applying a deterministic transformation, the attacker would need to decide whether to generate original human prose itself. Could future language models realistically enumerate every plausible love letter? Every plausible speech? Every short paragraph a person might naturally write? If they could, how would those generations be prioritized among the effectively limitless space of possible human expression?

My wager is that this construction has a high probability of surviving the fictional one hundred thousand year NSA scenario. I would estimate only around a 10–25% chance that the exact passage is eventually generated. This is another examples where I believe idea space might begin to dominate classical entropy. The challenge is no longer simply searching a known space efficiently, but deciding which of the countless forms of human thought are worth generating in the first place.

{Insert this entire article copy pasted verbatim.}

This construction explores using an entire original work of prose as a password. Unlike public documents, the article itself is a personal chain of reasoning, reflecting my own writing style, vocabulary, structure, and thought process. That individuality may simultaneously strengthen and weaken it. It is far less likely to appear in generic heuristic attacks, yet a sufficiently sophisticated attacker with extensive access to my personal writings may begin constructing increasingly accurate models of how I think and write.

Whether a deeply personal document is ultimately more secure than an impersonal one is difficult to answer. Personal writing benefits from uniqueness but is also vulnerable to profiling. Impersonal works are more broadly known but may receive less targeted attention. I cannot confidently say which property dominates.

Its sheer length alone places it well beyond anything I would expect conventional attacks to reproduce. I would speculate it would require some novel form of highly accurate behavioral prediction: an intelligence capable of modelling a person's thought processes by analyzing vast amounts of historical data through time. Such a system would likely require an almost universal understanding of the variables that shape human behavior.

All of that remained true—right up until I typed this section.

From here, the question becomes less about password construction and more about the effect disclosure itself has on security.

One of Diceware's greatest strengths is that it largely bypasses ordinary human heuristics. Attackers cannot exploit grammar, sentence structure, or meaningful associations because the words are selected independently and at random. Once generated, the password is simply another point in a very large search space.

Its practical limitation is human memory. Four words are generally manageable. Beyond that, recall becomes progressively more difficult, particularly if the password is used infrequently. A password that has not been entered for several years is, in my opinion, increasingly likely to be forgotten. This illustrates the tension explored throughout this paper: every additional word improves security, yet also increases the probability of self-lockout.

I would speculate at extreme levels of motivation and sophistication Diceware would have some weaknesses. I would wager the following in my hypothetical one hundred thousand year NSA scenario:

Within the fictional one hundred thousand year NSA scenario explored throughout this paper, I do not believe conventional Diceware recommendations would survive indefinitely. Diceware is a well-known best practice with a fixed public word list and an obvious attack strategy. The hypothesis is immediate: enumerate one word, then two, then three, and continue increasing the word count until the computational cost becomes prohibitive.

My intuition is that passwords in the practical range of three to five Diceware words remain excellent protection for ordinary people over ordinary human timescales. They are exactly the kind of passwords I would recommend for protecting the vast majority of personal information. However, they are also the kind of passwords I would expect a sufficiently capable attacker to prioritize because the attack rule is so obvious.

My speculative intuition is that somewhere around seven words the search space begins to exceed what even the fictional NSA could reasonably exhaust within one hundred thousand years. The exact threshold is unknowable because it depends entirely upon assumptions about future computation, but it illustrates the direction of travel: surviving the thought experiment requires progressively more words until the password itself becomes increasingly impractical for human memory.

I will use Diceware to champion an idea of an effective entropy that humans can memorize, it's likely the best example of this in a way that can be accurately audited. I will compare it here to Idea Space.

This is where I believe idea space begins to compete with classical entropy.

Consider the earlier Beatles example:

iwantto! repeated nine times, followed by holdyourhand# repeated eleven times.

I would personally bet on this construction over six or even seven Diceware words within the fictional NSA scenario. Not because I believe it possesses greater classical entropy—it almost certainly does not—but because it occupies a far less obvious hypothesis space.

Diceware presents the attacker with a single, well-defined family of rules whose magnitude can simply be increased as computation allows. The Beatles construction requires the attacker to first invent the rule itself by isolating specific parts of the human experience and combining them with arbitrary transforms. Once known, a narrow rule is inexpensive to execute. The uncertainty lies in whether it is ever prioritized among the effectively limitless number of plausible human cognitive constructions.

The attacker may eventually discover it. But if I were forced to choose between a password that relies purely on increasing entropy and one that also exploits uncertainty in human cognition, I would begin to favor the latter. That possibility is the central question this paper has been exploring.

I will tangent here momentarily as an exploration around human influence even in systems like Diceware.

The theoretical security of Diceware assumes that every dice roll is accepted exactly as it appears from the first roll. In practice, I suspect many people would feel tempted to reroll words they dislike or continue rolling until they obtain a sequence that feels more memorable or aesthetically pleasing. Every such choice reintroduces human preference into a system specifically designed to eliminate it. Whether this meaningfully reduces security depends on the extent of the cherry-picking, but it does move the construction away from the ideal randomness that gives Diceware its theoretical strength.

Above is a screenshot of one of my calculators encoding TIFA LOCKHART into BaseTIFA LOCKHART. Does this posting permanently make the outcome of that insecure forever? My website has an interface section where I provide a variety of calculators. Has this entire family of passwords become heuristically obvious simply because the transform is now public? Does this extend just to me or to all?

Above is a photograph of the dice I rolled before generating the Diceware passphrase protecting my most valuable data. Does showing this image cause the entropy of that password todecreased, even if only by an immeasurably small amount? Could some future technology, perhaps an unimaginably advanced AI, analyze that single frozen moment in time and recover information about the outcome of the roll that today appears impossible to extract?

Following this line of thought to its extreme, would simply mentioning that I have a friend who performs ultrasounds slightly reduce the security of every project associated with me? Has every publicly observable action I have ever taken, no matter how ordinary, marginally reduced the uncertainty surrounding every future security project I might be involved with? To a sufficiently advanced attacker willing to model every detectable aspect of my life, does every piece of information become a small reduction in entropy? Is every action I take or make in a publicly detectable way a diminishing of the entropy of everything I'm associated with? Is every public action anyone makes diminishing the entropy of all future security in the universe? Is something with no public information still leaking information by having no information?

If I were to publish a highly sensitive encrypted file on a public forum, protected only by a password, how much would this paper diminish the security of that file? Could the existence of this paper ever improve its security by introducing so many competing ideas that it becomes more difficult for an attacker to determine which ones I actually used?

Suppose a criminal could anonymously submit unlimited evidence that was genuinely created by them but intentionally misleading. Every submission could consume investigative effort, yet each submission would also reveal something about the criminal's thinking. Does introducing false hypotheses ultimately make an investigation more difficult, or does every additional clue, even a deceptive one, increase the probability of eventually discovering the truth?

!E7vc9{e<8e{0b9k05vKe@vLvI#VBbN!T

One possible distinction between deterministic rules and natural language is the cost of generating candidates. A password consisting of coherent, personally authored prose, such as the love letter discussed earlier, may eventually be expressible by future language models, but today it appears to require substantially more than simple algorithmic transformations. Producing meaningful prose often involves a language model, potentially tuned to an individual's writing style, with every candidate carrying computational cost and inference time beyond that of conventional rule-based generation. Whether this distinction remains meaningful as language models improve is an open question, but today it represents a different class of attack than traditional deterministic heuristics.

Human password behavior is unlikely to remain static. If conventional human-generated passwords continue to become easier to crack, society may gradually adopt more creative memory strategies out of necessity. Techniques that appear unusual today—extreme repetition, transform-based constructions, references to large documents, or other mnemonic systems—may eventually become standardized recommendations. Should that occur, today's unconventional ideas would become tomorrow's low-hanging fruit as attackers adapt their models to reflect evolving human behavior. In this sense, hypothesis space is not fixed. It evolves alongside culture, education, software, and accepted security practices.

Throughout this paper I assume an attacker of extraordinary sophistication. Under that assumption, discussing a password strategy with any system outside your direct control should be considered a potential disclosure.

It is easy to think only of information that is intentionally sent, but modern software often observes much more than that. Emails, web browsers, cloud services, search engines, large language models, collaborative editors, and countless other applications may retain logs for debugging, analytics, training, security, or legal purposes. In some cases even partial drafts, keystrokes, or text that is typed and later deleted before being sent may still have been sent and exists somewhere outside the user's awareness.

At the level of attacker considered throughout this paper, the user cannot confidently know where every piece of information ultimately resides, how long it persists, whether it is later leaked, purchased, subpoenaed, compromised, or intentionally collected. My practical conclusion is therefore conservative. If a password strategy is intended to protect information of exceptional importance, I would avoid discussing or experimenting with that strategy anywhere that is not entirely under my own control.

At this threat level I would not even muse it's strategy in a private room alone, in consideration of devices and who nows what else might be deployed to gather data. Perhaps this is futile, and leaks occur at the operating system level, or some vector we can't fathom, maybe we should simply have 0 confidence in any privacy.