5 ms·

I'm porting over all my passwords to a formula. The basic gist is that I have a set of rules that dictate what my password should be based on something such as

I'm porting over all my passwords to a formula. The basic gist is that I have a set of rules that dictate what my password should be based on something such as the the name of the website or service I'm using. so let's say we're talking about hotmail. I don't have a hotmail account, but the formula could be something like. Take the first, third and fourth letters of "hotmail" "htm" now the letters 3 spaces to the left of each of those in capitals (wrap to the right of the keyboard if you run out of space) "htmDWV" and sandwich in between the upper and lower case letters the numerical value of the last three numbers "htm42322DWV" And so on until I have a formula that I like that generates suitably obscure and difficult passwords. I plan to build an app or a script that processes "hotmail" according to my formula, copies it to the pasteboard ready to be pasted. 100% secure? No. But it'll do for me.

cfinke 16y ago
In this case, you really still only have one password (the formula that generates your passwords), and saving a script that runs that formula is the same as someone else putting their single password on a Post-It.
- tomelders 16y ago
  I'm well aware of this, but if my laptop falls into the wrong hands, I'm screwed anyway since (like most people) I'm permanently logged into most things anyway.
wewyor 16y ago
I use keepass with something like a 30 character password that I can remember with numbers and special characters, it already has things like autotype and copy paste and generates random secure passwords for sites I use which are then encrypted. My eggs may be all in one basket but at least that basket is heavily protected while your solution seems less good than the alternatives that already exist.
- jwegan 16y ago
  I use a similar technique (although I didn't make a script for it). I fail to see how it is "less good" [sic]. My password for every website is unique (15+ characters, mix of character cases, special characters, etc), it is not stored anywhere other than my brian, and the pattern is not easily discernable. Furthermore I have two different patterns, one for high value sites and a different one for social networks/forums/other low value sites. With keeppass, someone with a keylogger on your machine can compromise all your passwords in one fell swoop.
- metachris 16y ago
  And I simply store the encrypted password database in my Dropbox, which automatically syncs it across all machines I'm using (including my Android phone).
tokenadult 16y ago
I use a process somewhat like this (but simpler) and thus have a unique password for each site. I do this with my BRAIN, not with a script on my computer. I can prompt my memory with notes I keep in a secure location. I write the notes in a mixture of other languages I know, besides English, so that it is very hard for an onlooker even to recognize that they are notes about how I construct passwords. I change my passwords for my sites with the most potential for spoofing or other mishaps (currently Gmail and Facebook) from time to time.
zlopid 16y ago
I do something similar, but my "formula" also takes a few other inputs, like the security level of the website and the number of times I've had to change the password for regular password changes. The hope is that I have a hard-to-brute-force password, and if one password is revealed, it won't be a key for all my other accounts, but I only have one thing to remember for dozens of accounts. I can't even tell you the number of times I've gone to a website, said to myself, "I know I have an account here...was it before or after I started using the password formula?" and applying the formula gets me into my account.
troyhunt 16y ago
So what do you do when the website doesn't allow those characters in your password? It happens frequently: http://troy.hn/dJbdTU http://troy.hn/dJbdTU

cfinke 16y ago

In this case, you really still only have one password (the formula that generates your passwords), and saving a script that runs that formula is the same as someone else putting their single password on a Post-It.

tomelders 16y ago
I'm well aware of this, but if my laptop falls into the wrong hands, I'm screwed anyway since (like most people) I'm permanently logged into most things anyway.

wewyor 16y ago

I use keepass with something like a 30 character password that I can remember with numbers and special characters, it already has things like autotype and copy paste and generates random secure passwords for sites I use which are then encrypted. My eggs may be all in one basket but at least that basket is heavily protected while your solution seems less good than the alternatives that already exist.

jwegan 16y ago
I use a similar technique (although I didn't make a script for it). I fail to see how it is "less good" [sic]. My password for every website is unique (15+ characters, mix of character cases, special characters, etc), it is not stored anywhere other than my brian, and the pattern is not easily discernable. Furthermore I have two different patterns, one for high value sites and a different one for social networks/forums/other low value sites. With keeppass, someone with a keylogger on your machine can compromise all your passwords in one fell swoop.
metachris 16y ago
And I simply store the encrypted password database in my Dropbox, which automatically syncs it across all machines I'm using (including my Android phone).

tokenadult 16y ago

I use a process somewhat like this (but simpler) and thus have a unique password for each site. I do this with my BRAIN, not with a script on my computer. I can prompt my memory with notes I keep in a secure location. I write the notes in a mixture of other languages I know, besides English, so that it is very hard for an onlooker even to recognize that they are notes about how I construct passwords. I change my passwords for my sites with the most potential for spoofing or other mishaps (currently Gmail and Facebook) from time to time.

zlopid 16y ago

I do something similar, but my "formula" also takes a few other inputs, like the security level of the website and the number of times I've had to change the password for regular password changes. The hope is that I have a hard-to-brute-force password, and if one password is revealed, it won't be a key for all my other accounts, but I only have one thing to remember for dozens of accounts. I can't even tell you the number of times I've gone to a website, said to myself, "I know I have an account here...was it before or after I started using the password formula?" and applying the formula gets me into my account.

troyhunt 16y ago

So what do you do when the website doesn't allow those characters in your password? It happens frequently: http://troy.hn/dJbdTU http://troy.hn/dJbdTU