3 ms·

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique. What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to?

yeukhon 9y ago
> What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to? Good question. I just start with 2 (yes, that's weird) and then increment every time or choose the symbol so I eventually exhaust. This is the same question for unique password per different types/groups of websites. The good thing is more websites have abandoned the annoying security question/answer when it comes to forgot password/forgot username. Just straight to SMS/email. For example I cannot remember my cable provider's online account password. The policy is just ridiculous, so I use "forgot password" every single time. Email only, quick and simple. Please for everyone reading this - please abandon security questions as a requirement and stop being so hard on password requirement such as limiting the length (Twilio I am looking at you, yes). Just ask for a long password and give hints to users how to choose a good password. While the argument for complex password is to increase the search entropy, let's spend more time on securing your server and mitigating common attacks. Users will probably just append a number. So "myAwesomePassword$" is easy to try once "myAwesomePassword" is compromised from another service. Educate your users. Let user be responsible; I have my "secure" complex rules for password, let me be in control, I don't want to bend to meet your requirement. Another alternative is always ask for a one-time password (but a lot of users will find that very inconvenience). Choose one.
h4waii 9y ago
Ehh. Any password cracker worth their salt would be able to use rules to break hashes created by "The Algorithm", especially easier once the base word has been figured out or supplied by a single plain-text leak.
- ProblemFactory 9y ago
  Yes, the algorithm is breakable with a few examples to figure out the base word and the pattern. But this requires human attention at your personal algorithm. Unless you are enough of a celebrity or public figure to be personally targeted, nobody will bother. A password leak is going to have 100 million accounts in it, at least 50% of these reused without modification at other websites. Any automated bots and spammers will just try the exact passwords on other sites. If it doesn't work, they move on to the next account and password, instead of trying to guess modifications of non-working passwords.

yeukhon 9y ago

> What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to? Good question. I just start with 2 (yes, that's weird) and then increment every time or choose the symbol so I eventually exhaust. This is the same question for unique password per different types/groups of websites. The good thing is more websites have abandoned the annoying security question/answer when it comes to forgot password/forgot username. Just straight to SMS/email. For example I cannot remember my cable provider's online account password. The policy is just ridiculous, so I use "forgot password" every single time. Email only, quick and simple. Please for everyone reading this - please abandon security questions as a requirement and stop being so hard on password requirement such as limiting the length (Twilio I am looking at you, yes). Just ask for a long password and give hints to users how to choose a good password. While the argument for complex password is to increase the search entropy, let's spend more time on securing your server and mitigating common attacks. Users will probably just append a number. So "myAwesomePassword$" is easy to try once "myAwesomePassword" is compromised from another service. Educate your users. Let user be responsible; I have my "secure" complex rules for password, let me be in control, I don't want to bend to meet your requirement. Another alternative is always ask for a one-time password (but a lot of users will find that very inconvenience). Choose one.

h4waii 9y ago

Ehh. Any password cracker worth their salt would be able to use rules to break hashes created by "The Algorithm", especially easier once the base word has been figured out or supplied by a single plain-text leak.

ProblemFactory 9y ago
Yes, the algorithm is breakable with a few examples to figure out the base word and the pattern. But this requires human attention at your personal algorithm. Unless you are enough of a celebrity or public figure to be personally targeted, nobody will bother. A password leak is going to have 100 million accounts in it, at least 50% of these reused without modification at other websites. Any automated bots and spammers will just try the exact passwords on other sites. If it doesn't work, they move on to the next account and password, instead of trying to guess modifications of non-working passwords.