3 ms·

This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

• EGreg 10y ago
  Do you realize that your AWS account can be compromised without something like this?
  • justinludwig 10y ago
    Using different usernames/emails for different services is not a bad idea (particularly as a defense against untargeted attacks). But using a simple algorithm for generating passwords (ie pretty much any algorithm a human can remember) is playing with fire -- if an attacker can recover your generated passwords from just a few different services (via lucky crack from a db dump, or some site stored or transmitted or logged it in plaintext, or you were phished, or you created an account to try out someone's random mvp on a slapdash server that was already pwnd, etc), a human attacker will be able to figure out your username/password for all of your services. (And if we're not there already, it won't be too long before automated password crackers can do the same.) Plus, from a practical standpoint, what do you do when a site forces you to change your password because they fear their password db has been compromised (or has asinine rules about your password being too long, or make you rotate your password every 90 days, or they change their domain name 5 times in 3 years)?
• nitrogen 10y ago
  I imagine password cracking apps are also smart enough to try letters from the site domain combined with other known base passwords (dictionary words, common substrings from other password leaks, etc.).
• CamperBob2 10y ago
  99.999% of users will never experience a "well-planned targeted attack." Making us jump through the same security hoops that can protect high-value targets is annoying.
  • tonmoy 10y ago
    Anyone could become a target anytime. An attacker would just have to attack one person at a time.
    • deleted 10y ago
      [deleted]