3 ms·
I disagree. In this case "evidence collected suggests a password scheme where disclosure on one site made it easy to guess passwords for unrelated webpages" (e
by scoot 8y ago
I disagree.
In this case "evidence collected suggests a password scheme where disclosure on one site made it easy to guess passwords for unrelated webpages" (emphasis mine), however it is trivially easy to create formula-based passwords that are not immediately obviously related to the site for which they were created.
Take some combination of:
Number of characters in the URL
Number of syllables in the URL
Number of characters in the first / last syllable
Index in the alphabet of the Nth character of the first / last syllable
Nth character in the URL
Character offset in the URL according number of syllables
Nth symbol on the number key row according to number of characters in the URL
Alt-key symbol for the URL character in the URL
Etc, etc, etc.
Interspersed memorable seeds.
It would take serious effort to even detect the presence of a formulaic password from a single leaked unhashed / unsalted password, never mind to determine what the formula might be.
- snowwolf 8y ago>> from a single leaked unhashed / unsalted password These days it’s becoming more common to have been compromised from multiple sources. And unfortunately storing passwords securely seems to still be too hard for a lot of companies. The more examples of your pattern an attacker has, the easier to work out your pattern. With the frequency of new breach announcements I feel like you’re going to be fighting a losing battle. For now the best and safest solution is unique truly random passwords per site.
- Faark 8y agoYou can still pass your formula based password though a cryptographic hash function and would be fine. Although not very useful for device logins and as mentioned in some other comment probably trick to rotate passwords.