3 ms·
> For example, we told campaigns it was best to have a password manager, okay to have a written list of random passwords, dangerous to have a password pattern y
by losvedir 7y ago
> For example, we told campaigns it was best to have a password manager, okay to have a written list of random passwords, dangerous to have a password pattern you would modify across sites, and unacceptable to re-use a single password across sites.
As someone who likes the "password pattern" approach (remember one thing and use it to generate passwords for all sites), what's the threat model here? How is it dangerous?
- idlewords 7y agoTwo things off the top of my head: computers today can chew through a frightening number of passwords per second, so your pattern is almost certainly guessable. And second, you're more susceptible to phishing than if you used a password manager.
- lostphilosopher 7y agoThe general answer: Your pattern is a single point of failure. If someone figures it out they can figure out your passwords to multiple sites. The most likely threat is your password to one site leaks or gets fished and then the hackers recognizes it as pattern generated and reverse engineers the pattern. Then they just start trying that pattern on other sites. Not doing this is good general advice. Your specific risk level varies based on the pattern you use.
- kayfox 7y agoOne or more compromised passwords could reveal the pattern and at that point you might as well have just used the same password.
- UncleMeat 7y agoPeople suck at doing this consistently. We observe that people who claim to do this actually end up reusing passwords. It also becomes difficult to rotate passwords.