6 ms·

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site nam

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just remember the system.

chii 10y ago
Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...
- DominikSerafin 10y ago
  What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.
  - ntlve 10y ago
    They would also need access to the machine which you have your vault stored on which would be your laptop and your phone and nothing else.
  - Shank 10y ago
    Your master password shouldn't really be something that's going to be in either a dictionary, or brute forcible. Nobody is going to "get" it unless you make it insecure. If you're using their sync services, however (especially LastPass), you're more vulnerable to phishing attacks, and the vault can potentially be stolen and crack attempts run offline. However, both services use a heavy level of encryption that requires the passphrase to unlock, so as long as that's not dictionary based or brute forcible, you're totally fine.
- fastball 10y ago
  In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would). If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.
  - have_faith 10y ago
    This is true. I don't think the system is obvious unless you had multiple passwords, on top of that it's not immediately obvious that there is a system in the first place from looking at the plaintext password.
jrs235 10y ago
When one of the sites you use gets breached, you'll want/need to change your password and won't be able to use the same single algorithm. This will throw things of as you won't be able to use a single algorithm. Sure you could not use two. But you'll need to remember what sites use which one.
- fastball 10y ago
  It's a pretty shitty algo if someone can reverse engineer it with a sample of 1...
- softawre 10y ago
  not to mention forced password recycling.
philovivero 10y ago
How do you deal with websites that won't let you use >8char or certain characters? I use this same method, but my method will often generate special characters, and AWS as an example, and several others (apparently following AWS' lead) won't let you use those. (Any punctuation not on the shift-numbers row of USA keyboards are not considered legit for password use) I still mostly use this system, and given my lucky memory I can memorise the exceptions, but I doubt a vast majority of the population could follow my example.
- have_faith 10y ago
  I basically just have a system for altering the generated passwords based on the specific site requirements. For instance if it requires a max num of chars then I will just chop off the password at that amount. And similar systems for other requirements.

chii 10y ago

Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...

DominikSerafin 10y ago
What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.
- ntlve 10y ago
  They would also need access to the machine which you have your vault stored on which would be your laptop and your phone and nothing else.
- Shank 10y ago
  Your master password shouldn't really be something that's going to be in either a dictionary, or brute forcible. Nobody is going to "get" it unless you make it insecure. If you're using their sync services, however (especially LastPass), you're more vulnerable to phishing attacks, and the vault can potentially be stolen and crack attempts run offline. However, both services use a heavy level of encryption that requires the passphrase to unlock, so as long as that's not dictionary based or brute forcible, you're totally fine.
fastball 10y ago
In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would). If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.
- have_faith 10y ago
  This is true. I don't think the system is obvious unless you had multiple passwords, on top of that it's not immediately obvious that there is a system in the first place from looking at the plaintext password.

jrs235 10y ago

When one of the sites you use gets breached, you'll want/need to change your password and won't be able to use the same single algorithm. This will throw things of as you won't be able to use a single algorithm. Sure you could not use two. But you'll need to remember what sites use which one.

fastball 10y ago
It's a pretty shitty algo if someone can reverse engineer it with a sample of 1...
softawre 10y ago
not to mention forced password recycling.

philovivero 10y ago

How do you deal with websites that won't let you use >8char or certain characters? I use this same method, but my method will often generate special characters, and AWS as an example, and several others (apparently following AWS' lead) won't let you use those. (Any punctuation not on the shift-numbers row of USA keyboards are not considered legit for password use) I still mostly use this system, and given my lucky memory I can memorise the exceptions, but I doubt a vast majority of the population could follow my example.

have_faith 10y ago
I basically just have a system for altering the generated passwords based on the specific site requirements. For instance if it requires a max num of chars then I will just chop off the password at that amount. And similar systems for other requirements.