4 ms·

Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to

Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way. That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNews). I have a single master password, the rest of my passwords aren't compromised if I accidentally expose one of them, and I can log in to any site from any device with a browser. Of course, use 2FA when you can, but it's nice to have a secure first layer of defense.

bbyford 9y ago
Lesspass is the bomb and the way forward. Never had an issue with it and never had to give any internet bassed app or distrubted app my "master password/s". So strongly recommend.
mason55 9y ago
It’s very unlikely anyone will take the time to figure out your pattern unless you’re a high value target. If your password just gets exposed as part of a credential dump among 100 million others then the thieves will automate their attempts to try your password other places and it will fail. If you’re a high value target then you shouldn’t do this
SeanLockItUp 9y ago
> Doesn't this compromise all of your passwords if one of your passwords is discovered? I've been trying to understand password managers for a while. My workplace forces us to use one. But what you've said doesn't make sense. If your "master password" used in the password manager is discovered, then all your passwords are compromised. If my laptop or phone gets stolen and someone knows the password from my password manager, then I'm done for. I choose to follow the algorithm approach too. Even though it's BS.
- oneeyedpigeon 9y ago
  Yes, but that master password should a) be incredibly secure (mine is longer than 32 characters) b) only be used for your password manager and nothing else. If, instead, you reuse a password in several places, you're only as secure as the weakest link in that chain.
- Kagerjay 9y ago
  I run lastpass, I only use a unique password for that application. I also rotate that password every few months. I also have it set to 2FA with google authenticate, so I need to have my phone everytime I log in. It takes longer to login but its worth it So even if my password were compromised by a keylogger / brute force, you would still need to have access to my phone. I don't use lastpass on my phone so that's not a nonissue for me. I don't link my phone to my computer at all (airdroid, teamviewer, etc). You would need to have - My master lastpass password - My unique phone password and my phone Both events are kind of unlikely to happen. I worry more about lastpass leaking passwords than me being hacked at any point, since this is the major disadvantage of using lastpass over keepass. lastpass is nice since I can just make autogenerated throwaway passwords and have a way to take notes on passwords I change over time
PurpleRamen 9y ago
You can always enhance the algorithm. For example, use multiple base password, and arrange them based on the servicename. So hunter2 for everything that starts with h or a-c or a-k or with 5 characters. It's your choice how complicated it becomes. Additionally you can mutate the servicepart. Like break it up every n characters, or every syllable and add some service-specific value in. Maybe use the lenght of the servicename multiplied with the number of syllables plus 4. You could also use a random characterstring, lets say the ones from numberrow, and calculate entrys whith those numbers. Like, move by n syllables for every char you add. It's not really hard to make a rather complicate algirithm with the tools you have around you. It's just cumbersome to remember and execute it in case you need it. So unless you really fear to be personal targeted, it's not worth the pain.

bbyford 9y ago

Lesspass is the bomb and the way forward. Never had an issue with it and never had to give any internet bassed app or distrubted app my "master password/s". So strongly recommend.

mason55 9y ago

It’s very unlikely anyone will take the time to figure out your pattern unless you’re a high value target. If your password just gets exposed as part of a credential dump among 100 million others then the thieves will automate their attempts to try your password other places and it will fail. If you’re a high value target then you shouldn’t do this

SeanLockItUp 9y ago

> Doesn't this compromise all of your passwords if one of your passwords is discovered? I've been trying to understand password managers for a while. My workplace forces us to use one. But what you've said doesn't make sense. If your "master password" used in the password manager is discovered, then all your passwords are compromised. If my laptop or phone gets stolen and someone knows the password from my password manager, then I'm done for. I choose to follow the algorithm approach too. Even though it's BS.

oneeyedpigeon 9y ago
Yes, but that master password should a) be incredibly secure (mine is longer than 32 characters) b) only be used for your password manager and nothing else. If, instead, you reuse a password in several places, you're only as secure as the weakest link in that chain.
Kagerjay 9y ago
I run lastpass, I only use a unique password for that application. I also rotate that password every few months. I also have it set to 2FA with google authenticate, so I need to have my phone everytime I log in. It takes longer to login but its worth it So even if my password were compromised by a keylogger / brute force, you would still need to have access to my phone. I don't use lastpass on my phone so that's not a nonissue for me. I don't link my phone to my computer at all (airdroid, teamviewer, etc). You would need to have - My master lastpass password - My unique phone password and my phone Both events are kind of unlikely to happen. I worry more about lastpass leaking passwords than me being hacked at any point, since this is the major disadvantage of using lastpass over keepass. lastpass is nice since I can just make autogenerated throwaway passwords and have a way to take notes on passwords I change over time

PurpleRamen 9y ago

You can always enhance the algorithm. For example, use multiple base password, and arrange them based on the servicename. So hunter2 for everything that starts with h or a-c or a-k or with 5 characters. It's your choice how complicated it becomes. Additionally you can mutate the servicepart. Like break it up every n characters, or every syllable and add some service-specific value in. Maybe use the lenght of the servicename multiplied with the number of syllables plus 4. You could also use a random characterstring, lets say the ones from numberrow, and calculate entrys whith those numbers. Like, move by n syllables for every char you add. It's not really hard to make a rather complicate algirithm with the tools you have around you. It's just cumbersome to remember and execute it in case you need it. So unless you really fear to be personal targeted, it's not worth the pain.