4 ms·

Here is a fairly simple alternative to this or using a password manager: 1. Remember a high-entropy “base” password that is likely to pass complexity and lengt

by Lxr 10y ago

Here is a fairly simple alternative to this or using a password manager: 1. Remember a high-entropy “base” password that is likely to pass complexity and length requirements 2. Invent a weird way to incorporate the name or domain name of the product you’re using into this password to make it unique (e.g. “put the second letter of the domain name as the third-last character of your password”) Advantages: Memorable but unique password for all or most services, no need for physical books that can be stolen, works on any machine. If one of your passwords is discovered, it's basically useless beyond that service unless the attacker knows your step 2.

nommm-nommm 10y ago
Disadvantages: do I have an account on this site? What email address did I use to sign up? What is my username (Many have user name requirements)? My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Now you are remembering tons of special cases. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme.
- Lxr 10y ago
  do I have an account on this site? What email address did I use to sign up? Fair point but often there are not too many possibilities. What is my username Your email address, in most cases. My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Occasionally a problem, but I have been using this method for years and have maybe two or three passwords that I have to manually remember for reasons like this. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme. True, but then one can similarly come up with scenarios for most other schemes. I agree it's not perfect and won't cover every case, but it has worked well for me.
  - nommm-nommm 10y ago
    >What is my username. >Your email address, in most cases. I have accounts with, like, a bazillion different financial institutions. They all require user names that have length requirements and special character/number requirements. I would forget all my user names if it weren't for password managers. If you have one bank, no 401k, no IRA, no credit cards, two social media accounts, one email address, and do all your online shopping on Amazon, and not much else this sort of disadvantage won't pop up but once you get into multiple accounts on multiple sites it does not scale. If you have many password schemes you'd also have to remember the password rules for every single site.
    - dave2000 10y ago
      What would be nice would be if all sites supported this system: 1) go to site 2) enter email address (cached by the browser) 3) go to email account 4) click on long, unguessable link which is only valid for 2 minutes) er..that's it. You could even skip the `enter email address` step and just get users to keep a link provided in the initial signup process. This link could either be the one you always use to log in, or for better security could prompt the remote site into sending you another single-use login link (as above).
      - jakub_g 10y ago
        Well most sites do support the feature. It's called password reset and I use it heavily in fact. I use keepass, but sometimes for services that I use once per year, I just go via password reset and change password to a long random gibberish and do not even bother to write it down to keepass.
        dave2000 10y ago
        No, it's nothing like password reset. My proposed system doesn't even need a password.
      - nommm-nommm 10y ago
        This is how Craigslist posts work. You can create a password if you want but you by no means need one. You don't even have to "create an account."

by Lxr 10y ago

nommm-nommm 10y ago

Disadvantages: do I have an account on this site? What email address did I use to sign up? What is my username (Many have user name requirements)? My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Now you are remembering tons of special cases. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme.

Lxr 10y ago
do I have an account on this site? What email address did I use to sign up? Fair point but often there are not too many possibilities. What is my username Your email address, in most cases. My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters. Occasionally a problem, but I have been using this method for years and have maybe two or three passwords that I have to manually remember for reasons like this. If you are specifically targeted they can compare your password in two hacked databases and find out your scheme. True, but then one can similarly come up with scenarios for most other schemes. I agree it's not perfect and won't cover every case, but it has worked well for me.
- nommm-nommm 10y ago
  >What is my username. >Your email address, in most cases. I have accounts with, like, a bazillion different financial institutions. They all require user names that have length requirements and special character/number requirements. I would forget all my user names if it weren't for password managers. If you have one bank, no 401k, no IRA, no credit cards, two social media accounts, one email address, and do all your online shopping on Amazon, and not much else this sort of disadvantage won't pop up but once you get into multiple accounts on multiple sites it does not scale. If you have many password schemes you'd also have to remember the password rules for every single site.
  - dave2000 10y ago
    What would be nice would be if all sites supported this system: 1) go to site 2) enter email address (cached by the browser) 3) go to email account 4) click on long, unguessable link which is only valid for 2 minutes) er..that's it. You could even skip the `enter email address` step and just get users to keep a link provided in the initial signup process. This link could either be the one you always use to log in, or for better security could prompt the remote site into sending you another single-use login link (as above).
    - jakub_g 10y ago
      Well most sites do support the feature. It's called password reset and I use it heavily in fact. I use keepass, but sometimes for services that I use once per year, I just go via password reset and change password to a long random gibberish and do not even bother to write it down to keepass.
      - dave2000 10y ago
        No, it's nothing like password reset. My proposed system doesn't even need a password.
    - nommm-nommm 10y ago
      This is how Craigslist posts work. You can create a password if you want but you by no means need one. You don't even have to "create an account."