3 ms·

That's certainly a vulnerability, though a pretty small one. Most huge credential compromises that result in other accounts being hijacked are done programmatic

That's certainly a vulnerability, though a pretty small one. Most huge credential compromises that result in other accounts being hijacked are done programmatically: It's not like the script that's checking if your gawker password matches your gmail password will try permutations after first attempt. I really like your mechanism for secure passwords. Though it's definitely more time intensive. 1Password has been praised highly by a couple coworkers and I've been meaning to try it -- the problem is, you should still have strong passwords for individual services even if you're strong them in a single repository like 1Password. I think my formula is decent, though by no means totally secure.

tzs 16y ago
1Password (and most other password managers, I believe) are happy to generate strong passwords for you. I generally actually have no idea what my password is at most sites, as I let 1Password deal with that. Here are a few samples. I've asked it for 16 character random passwords with 2 digits and 2 symbols, repetition allowed and ambiguous characters allowed: xQO3<hCnp^uKh7mP t0ee4uHIsQv'Kk<Z zXS;DY3)U3OzAebT It also lets you ask for pronounceable passwords, although you generally then nead longer passwords for good strength. Here are some examples: cac-kon-eg-voil-eng-es- rhook-bea-say-rou-hen-h ju-cadd-irv-iaf-moif-do I'll use that kind if I'm using 1Password just for storage, not automatic entry (for example, the login password for a game client). You can also ask for digits instead of dashes in the pronounceable passwords, like this: ho9swap4cyat6lold9us6bu or no separators (requiring you ask for a longer password for the same strength), like this: mitalwebshefrufegbiheagdihet