4 ms·
Except until a couple of sites leak their plaintext passwords, and the attacker can start piecing information together. Bob@foomail.com's PW on Yahoo.com was Zu
by vesinisa 10y ago
Except until a couple of sites leak their plaintext passwords, and the attacker can start piecing information together. Bob@foomail.com's PW on Yahoo.com was ZuBrDfPgPg, and on Patreon.com SkBrOxPdGqPgLu. Any chance his PW for Therapy.com might be OxDfGqPdBrSkZu?
Such attack is more attractive and more effective the more people use this specific method.
- tomjen3 10y agoI highly, highly doubt that anybody is going to do that as a general attack vector. Computers change, but people are people and are not like, in great numbers, to suddenly start having good passwords, just as they are not likely to suddenly start exercising.
- rocqua 10y agoYou are essentially relying on security through obscurity, it might work but it fails to add security when viewed through Kerckhoffs's principle.
- chris_st 10y agoTrue. However, the article here is talking about bulk encryption of thousands of passwords, and how "ordinary" word sets are easy to break. I think the "usual" case is that hackers want to get as many passwords as possible, and so singling out an individual for analysis is probably not worth the time, unless you're an "individual of interest" for some reason.
- EmployedRussian 10y agoHere you are using fixed passphrase and site name as the password, resulting in monosubstitution cypher, which is where the insecurity comes from. If you use site name as the passphrase and fixed password ("password" below) instead, you end up with: yahoo.com: dXgvRMjjHQvRQFvSa patreon.com: UdKiiXVxrCRjYe therapy.com: KFXUMnMnSrJLIjaB That seems quite a bit better (though you do lose ability to print the chart for off-line use). If an attacker knows your 3 plain text passwords and suspects that you use passwordchart.com, you are still in trouble.