Using different usernames/emails for different services is not a bad idea (particularly as a defense against untargeted attacks). But using a simple algorithm f

Using different usernames/emails for different services is not a bad idea (particularly as a defense against untargeted attacks). But using a simple algorithm for generating passwords (ie pretty much any algorithm a human can remember) is playing with fire -- if an attacker can recover your generated passwords from just a few different services (via lucky crack from a db dump, or some site stored or transmitted or logged it in plaintext, or you were phished, or you created an account to try out someone's random mvp on a slapdash server that was already pwnd, etc), a human attacker will be able to figure out your username/password for all of your services. (And if we're not there already, it won't be too long before automated password crackers can do the same.) Plus, from a practical standpoint, what do you do when a site forces you to change your password because they fear their password db has been compromised (or has asinine rules about your password being too long, or make you rotate your password every 90 days, or they change their domain name 5 times in 3 years)?