4 ms·
> Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. If. Depends a lot on
by usrusr 9y ago
> Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords.
If. Depends a lot on how easy that attacker can identify those accounts as belonging to one set. Easy when they all go to the same email, but deep in the realm of individually targeted attacks if there is a layer of redirection. It's a tradeoff, password managers come at the cost of making their users part of a very high value dragnet target. I guess the proper way to do it would be to augment managed passwords with a brain-based component. That, and stuffing the password manager with a few canary accounts on high-value sites that send out login notifications.
- donald123 9y agoIt would be pretty easy to identify accounts for same users. Most people use same email or username on most of their websites. The point of password managers are to have true different password for different site and users don't need to remember it. For the inconvenience the author has, there are other secure ways to handle that, no need to sacrifice security for convenience. For example, to have a usb drive with portable password manager installed.