9 ms·

Finally: A usable and secure password policy backed by science

72 points by soheilpro 6y ago

iandanforth 6y ago
Nope. No dictionary words is a non-starter. If I tried to enforce this as policy I'd get zero compliance.
- rmrfstar 6y ago
  It's a good point. One thing that would have been nice to see is a graph with several lines. X-axis is bits of entropy, Y-axis is recall rate. The individual lines reflect a single combination of (a) formatting scheme (e.g. diceware) and (b) reinforcement mechanism (e.g. type 20x once per day). I've run this experiment on myself and found that diceware with intra-word punctuation gives the highest entropy at the lowest effort.
- stordoff 6y ago
  Every password I need to remember has a dictionary word in it, because it's easy _additional_ entropy. Once I've got a password that's borderline too long to remember, I can't really add more random characters to it without risking forgetting it. Concatenating it with a dictionary word ("password-dictword") is much easier to remember, but (I believe) still adds a meaningful amount of security.
  - rmrfstar 6y ago
    It removes you from the list of people who get pwned with a rainbow table from leaked passwords, but that's not much security. English has only got ~1.2 bits of entropy per character. [1] [1] Table 1 in https://arxiv.org/pdf/1808.04444.pdf https://arxiv.org/pdf/1808.04444.pdf
    - ravi-delia 6y ago
      I was going to snarkily make a point about that figure only making sense in the context of grammatical english text, with the example of a randomly chosen 7 letter word being one of 32,909 options. log(32,909) is about 15. Which is of course 1.5 bits per character, and that's generously assuming that a person will actually randomly pick from all those potential options. So sorry for what I almost commented, but now I have to wonder why the entropy of a word on its own is so close to the entropy of a word in a sentence. Am I missing something? Is it just coincidence?
      - deleted 6y ago
        [deleted]
    - schoen 6y ago
      But entropy is relative to an attacker (it measures the attacker's uncertainty about your password). The 1.2 bits/character measurement is about grammatical English text that occurs in a communicative setting. That means that before you get there, you probably already know what word goes at the end of this sentence. You can measure this with human native speakers, or with a compression algorithm, or with a naive letter n-gram or word n-gram model, and get different statistics -- each of which is correct in the sense of each model's uncertainty about how the text continues. In the password setting, words can be used in all sorts of ways, some of which are very unpredictable to an attacker, so it's plausible that each word adds at least log₂(len(dictionary)) to the password entropy when it's chosen at random from a dictionary, even when the attacker expects that the password selection method could have used that dictionary.
      - deleted 6y ago
        [deleted]
vessenes 6y ago
I really liked the realtime “improve this password” options — you can follow a link in the article to try out the password helper. After playing with it, I believe that it gets better results on the security:memorability ratio than other available options. I think this plus something that queries password databases if made in drop-in javascript form would be a help to many sites.
newscracker 6y ago
It’s good to recommend that passwords be 12 characters or longer, and the password-strength meter seems good enough. I tested it with CorrectHorseBatteryStaple (from xkcd 936) and it said the password is strong. But what I didn’t like in the suggestions in the demo strength meter site is that it keeps suggesting that the user avoid dictionary words and add one more symbols or one more digits. > Your password is pretty good. Use it only for this account. (Why?) > To make it even better: > Don't use dictionary words (Correct, Battery, Staple and Horse) (Why?) > Consider using 1 or more symbols (Why?) > Consider using 1 or more digits This essentially goes against the advice that passwords should be complex but also easier to remember (yes, many people still don’t use password managers) and also the advice not to force users to add symbols or digits. I tried a few other different passwords and pass phrases with digits and symbols, but I saw a subtle coercion in the suggestions that would make a lay user doubt the password-strength meter and create extremely long and complex passwords (no pass phrases, since dictionary words and even terms in Wikipedia are flagged). It encourages you to add more digits and symbols even when you’ve already used a few. In short, the password-strength meter seems fine, but the suggestions are not great.
- paulryanrogers 6y ago
  If using a password manager then memorization is less useful while fully random passwords are considerably stringer.
- maven29 6y ago
  The average person's working vocabulary is 20,000 words, do you expect a layman to be able to produce a perfectly random combination out of the paltry 20000⁴ possible sequences. Will they reach into the outer edges of their vocabulary to use obscure words? Surely it would be biased towards common words, making even bcrypt pointless.
  - bradknowles 6y ago
    With respect, maybe your vocabulary is 20,000 words, but I submit that the average English-only speaker is more like about 10,000 words. This is a case where I choose to believe xkcd unless and until you can provide convincing evidence otherwise.
kazinator 6y ago
> Equipped with this state-of-the-art password meter, the researchers then approached password policies from a whole new perspective: with the idea that a password must achieve a certain threshold score on their password meter. That's the most obvious way to apply a meter, not a new perspective.
bhauer 6y ago
With the prevalence of password management, users are only expected to memorize a very small number of passwords. For me, I have two key passwords I must remember: my login credentials and the key to my password manager. I don't know why we fret so much about password complexity requirements. In my opinion, the solution is not increasing the ease of memorization, but encouraging those who don't use a password manager to do so.
- fuzxi 6y ago
  I would recommend memorizing the passphrase to your email as well. If you lose access to your password database for any reason, it's annoying but largely trivial to regain access to most sites, as long as you have access to your recovery email (and 2FA token, if applicable). If you lose access to your email as well, you're in a much worse position and may lose much of your digital life.
  - jeron 6y ago
    Not a bad idea. I once had a nightmare (a real one while sleeping) where I didn't have access to my phone or computer and thus had no access to my password manager, and was unable to log into a crucial account in the dream. It hasn't happened to me in real life but it was quite a wakeup call
  - somedude11 6y ago
    Buy your own domain and hosting so you can always regain access to it. It's hackernews so it astounds me that most people posting here use some free email instead of paying few buck for own domain and hosting.
    - ajb 6y ago
      Buying your own domain it's a great plan, but this not one of the problems it solves - you're just changing the crucial password from being your email one to your domain provider one.
      - 6y ago
ghoomketu 6y ago
I absolutely love Jetbrains products but the only thing I hate about their site is how insane the password rules are. Its like someone just wants to complicate things for no reason. I have to almost always use the forgot password link to login to their site because nobody can remember a password which satisfies all their rules (only other option is to save it to lastpass but that is not available on mobile) I hope that more companies consider this new password policy that is also easy to remember.
- sfeng 6y ago
  Maybe try 1Password? It is absolutely available on mobile.
  - DavideNL 6y ago
    1Password is an awesome app, insanely expensive in my opinion though; Once you get a subscription you're going to be stuck for a while, so at €38/year, for me and my partner, that makes €380 for a 5 year period! For a password manager... Free alternatives would be KeePassXC / Bitwarden / Strongbox (iOS).
hlieberman 6y ago
On the bottom of the page, there's an absolutely galaxy brain take that made me twitch: “A world that uses facial recognition does not look like Hollywood’s Minority Report. It looks like a smarter, more pleasant experience interacting with complex computer security systems to help make a safer world for our friends, our families and our children.” Marios Savvides, director of CyLab’s Biometrics Center
- refulgentis 6y ago
  I believe his point is comments like this are reductive, and more an indicator of pop culture familiarity than anything substantive about protecting user's privacy. minority report's facial recognition involved swarms of fist-sized flying insect robots invading apartments, and facial recognition on my iPhone allows me to secure my data from the state
  - soulofmischief 6y ago
    I walked into a shop once and was casually told the camera system routed to a central database shared with federal intelligence who uses facial recognition to match against terrorist and most-wanted databases. I thought that was a little concerning.
    - Aeolun 6y ago
      Why? Are you a terrorist or in a most-wanted database?
      - soulofmischief 6y ago
        For the last four years my country has had an extremely hostile leader that should dispel all confusion about how easy it is to become ideologically opposed and thus persecuted by your government over a short period of time simply for being a supporter of basic human rights.
        deleted 6y ago
betwixthewires 6y ago
TL;DR the secure password policy is to use their secure password test, the criteria of which are not divulged.
- DavideNL 6y ago
  The criteria are divulged, and it's all open source... https://github.com/cupslab/neural_network_cracking https://github.com/cupslab/neural_network_cracking
oefrha 6y ago
I recommend changing the link and title to the actual paper: http://www.andrew.cmu.edu/user/nicolasc/publications/Tan-CCS20.pdf http://www.andrew.cmu.edu/user/nicolasc/publications/Tan-CCS... IMO this accompanying press release is devoid of content and meaning even by typical university PR standards.
- rmrfstar 6y ago
  Yeah, the whole "backed by science" thing has a weird tinge of religiosity to it. I did notice that the article author has nothing whatsoever to do with the actual research.
  - AntiImperialist 6y ago
    Whenever I read that phrase, I instinctively know that they are trying to sell some bs that people would otherwise not even consider because of how little sense it makes.
    - raarts 6y ago
      Just like 'experts say' or 'research suggests'.
      - rmrfstar 6y ago
        "Research suggests" is better. It's an appeal to process, not authority.
kobayashimaru 6y ago
Securely use a compromised pasword cos u dont give a fuck is my policy
deleted 6y ago
[deleted]
Straw 6y ago
This perpetuates the fundamental misunderstanding on what makes passwords strong. In fact, no password itself has any guaranteed entropy and hence strength- only a distribution has this property. Since humans provide such poor randomness, we should never pick passwords at all, but generate them. Research should go to making more memorable generated passwords, looking for the best tradeoff between that and entropy.
- nmca 6y ago
  I had a (slightly silly) go at tackling this problem via a secure mapping and language-model reranking according to probability of text under urban dictionary - there is a detailed description here if you're curious: (pdf-link) https://n-mca.github.io/work/Nat_McAleese_Arbitrary_Encodings.pdf https://n-mca.github.io/work/Nat_McAleese_Arbitrary_Encoding...
- FabHK 6y ago
  That fundamental misunderstanding is not a misunderstanding. You can look at individual passwords and estimate their "entropy", such as zxcvbn does, and in fact you need to. Because the distribution that matters is not the one you used to pick the password, but the one that the attacker uses. You could pick from the universe of arbitrary UTF-8 strings of up to 1000 characters (huge entropy), and pull "password" - but that would be a bad password, despite the distribution. Or you could pick randomly from {"password", "09854yngbmoujcr08twnvgje8w6g7bkv,cmxm5^&*9NMF"}, and pick the latter, and it would be a reasonable password, despite carrying only 1 bit of information in the given distribution. > Research should go to making more memorable generated passwords, looking for the best tradeoff between that and entropy. Agreed on that.
  - Straw 6y ago
    Although by chance you might pick a good password, you have absolutely no guarantee of the strength unless its generated from a distribution with known entropy. The problem with assuming any particular distribution for the attackers is that they tend to constantly update their attacks as password trends evolve. Random password, picked uniformly from strings up to 1000 characters? Almost certainly at least 900 characters, extremely strong. Probability of picking "password"? Less than the probability you're currently hallucinating, or that there's a bug in your code, or that an attacker guesses your password by pure chance. You can't show that particular string isn't easy to guess- perhaps it follows a common pattern of humans spamming "random" keypresses with far lower entropy than one would expect. Can I show that I could guess something without seeing it beforehand? Probably not. Don't settle for "I couldn't guess this password" when you can get "No one can guess this password".
FabHK 6y ago
So, the end result of that paper is a password-quality-meter like zxcvbn (or presumably better)? (They do reference zxcvbn in the paper: "One of the more accurate password-strength estimators, zxcvbn [34], uses advanced heuristics to output quite reliable password strength estimates at low guess numbers typical of online attacks.")
- vimax 6y ago
  If I read the paper correctly: They trained a state-of-the-art password guessing NN. They used this to train a second NN to estimate the number of guesses needed by the first NN to guess a given password, and used this second NN as the password meter. A password is resistant to online attacks if it takes more than 10^6 guesses, and resistant to offline if it takes more than 10^14 guesses. After comparing combinations of password requirements, blocklists, and strength requirements, they found that minimum of 12 characters, and a NN estimate of more than 10^12 guesses is the best password requirements for usability and protection from offline attacks. So instead of heuristics for a strong password, they derive the strengths from how many attempts it would take a SotA NN to guess the password.
teetertater 6y ago
Here’s a password strategy I began using that allows me to commit every password to memory while keeping them unique (I don’t trust pw managers): Letters representing the service + Constant text + year + constant ascii E.g for this site it could be "hackblabla2020__#" Then for email it could be "emaiblabla2020__#" Then it also forces me to change it once a year-ish
- CJefferson 6y ago
  If someone really cared about hacking you, and one of those websites has a clear text password dump (which happens all the time), you are in serious trouble.
  - teetertater 6y ago
    I figured if someone really cared about hacking me I'd be screwed anyway. I should add that my most important accounts don't follow this pattern
- fingerlocks 6y ago
  I hope Constant Text is quite large, because otherwise you just announced the majority of your password to all of your logins. Consider deleting this post?
  - teetertater 6y ago
    Thanks for the concern. The examples I gave don't follow the real patterns/orders/Ascii I use

72 points by soheilpro 6y ago

iandanforth 6y ago

Nope. No dictionary words is a non-starter. If I tried to enforce this as policy I'd get zero compliance.

rmrfstar 6y ago
It's a good point. One thing that would have been nice to see is a graph with several lines. X-axis is bits of entropy, Y-axis is recall rate. The individual lines reflect a single combination of (a) formatting scheme (e.g. diceware) and (b) reinforcement mechanism (e.g. type 20x once per day). I've run this experiment on myself and found that diceware with intra-word punctuation gives the highest entropy at the lowest effort.
stordoff 6y ago
Every password I need to remember has a dictionary word in it, because it's easy _additional_ entropy. Once I've got a password that's borderline too long to remember, I can't really add more random characters to it without risking forgetting it. Concatenating it with a dictionary word ("password-dictword") is much easier to remember, but (I believe) still adds a meaningful amount of security.
- rmrfstar 6y ago
  It removes you from the list of people who get pwned with a rainbow table from leaked passwords, but that's not much security. English has only got ~1.2 bits of entropy per character. [1] [1] Table 1 in https://arxiv.org/pdf/1808.04444.pdf https://arxiv.org/pdf/1808.04444.pdf
  - ravi-delia 6y ago
    I was going to snarkily make a point about that figure only making sense in the context of grammatical english text, with the example of a randomly chosen 7 letter word being one of 32,909 options. log(32,909) is about 15. Which is of course 1.5 bits per character, and that's generously assuming that a person will actually randomly pick from all those potential options. So sorry for what I almost commented, but now I have to wonder why the entropy of a word on its own is so close to the entropy of a word in a sentence. Am I missing something? Is it just coincidence?
    - deleted 6y ago
      [deleted]
  - schoen 6y ago
    But entropy is relative to an attacker (it measures the attacker's uncertainty about your password). The 1.2 bits/character measurement is about grammatical English text that occurs in a communicative setting. That means that before you get there, you probably already know what word goes at the end of this sentence. You can measure this with human native speakers, or with a compression algorithm, or with a naive letter n-gram or word n-gram model, and get different statistics -- each of which is correct in the sense of each model's uncertainty about how the text continues. In the password setting, words can be used in all sorts of ways, some of which are very unpredictable to an attacker, so it's plausible that each word adds at least log₂(len(dictionary)) to the password entropy when it's chosen at random from a dictionary, even when the attacker expects that the password selection method could have used that dictionary.
    - deleted 6y ago
      [deleted]

vessenes 6y ago

I really liked the realtime “improve this password” options — you can follow a link in the article to try out the password helper. After playing with it, I believe that it gets better results on the security:memorability ratio than other available options. I think this plus something that queries password databases if made in drop-in javascript form would be a help to many sites.

newscracker 6y ago

It’s good to recommend that passwords be 12 characters or longer, and the password-strength meter seems good enough. I tested it with CorrectHorseBatteryStaple (from xkcd 936) and it said the password is strong. But what I didn’t like in the suggestions in the demo strength meter site is that it keeps suggesting that the user avoid dictionary words and add one more symbols or one more digits. > Your password is pretty good. Use it only for this account. (Why?) > To make it even better: > Don't use dictionary words (Correct, Battery, Staple and Horse) (Why?) > Consider using 1 or more symbols (Why?) > Consider using 1 or more digits This essentially goes against the advice that passwords should be complex but also easier to remember (yes, many people still don’t use password managers) and also the advice not to force users to add symbols or digits. I tried a few other different passwords and pass phrases with digits and symbols, but I saw a subtle coercion in the suggestions that would make a lay user doubt the password-strength meter and create extremely long and complex passwords (no pass phrases, since dictionary words and even terms in Wikipedia are flagged). It encourages you to add more digits and symbols even when you’ve already used a few. In short, the password-strength meter seems fine, but the suggestions are not great.

paulryanrogers 6y ago
If using a password manager then memorization is less useful while fully random passwords are considerably stringer.
maven29 6y ago
The average person's working vocabulary is 20,000 words, do you expect a layman to be able to produce a perfectly random combination out of the paltry 20000⁴ possible sequences. Will they reach into the outer edges of their vocabulary to use obscure words? Surely it would be biased towards common words, making even bcrypt pointless.
- bradknowles 6y ago
  With respect, maybe your vocabulary is 20,000 words, but I submit that the average English-only speaker is more like about 10,000 words. This is a case where I choose to believe xkcd unless and until you can provide convincing evidence otherwise.

kazinator 6y ago

> Equipped with this state-of-the-art password meter, the researchers then approached password policies from a whole new perspective: with the idea that a password must achieve a certain threshold score on their password meter. That's the most obvious way to apply a meter, not a new perspective.

bhauer 6y ago

With the prevalence of password management, users are only expected to memorize a very small number of passwords. For me, I have two key passwords I must remember: my login credentials and the key to my password manager. I don't know why we fret so much about password complexity requirements. In my opinion, the solution is not increasing the ease of memorization, but encouraging those who don't use a password manager to do so.

fuzxi 6y ago
I would recommend memorizing the passphrase to your email as well. If you lose access to your password database for any reason, it's annoying but largely trivial to regain access to most sites, as long as you have access to your recovery email (and 2FA token, if applicable). If you lose access to your email as well, you're in a much worse position and may lose much of your digital life.
- jeron 6y ago
  Not a bad idea. I once had a nightmare (a real one while sleeping) where I didn't have access to my phone or computer and thus had no access to my password manager, and was unable to log into a crucial account in the dream. It hasn't happened to me in real life but it was quite a wakeup call
- somedude11 6y ago
  Buy your own domain and hosting so you can always regain access to it. It's hackernews so it astounds me that most people posting here use some free email instead of paying few buck for own domain and hosting.
  - ajb 6y ago
    Buying your own domain it's a great plan, but this not one of the problems it solves - you're just changing the crucial password from being your email one to your domain provider one.
    - 6y ago

ghoomketu 6y ago

I absolutely love Jetbrains products but the only thing I hate about their site is how insane the password rules are. Its like someone just wants to complicate things for no reason. I have to almost always use the forgot password link to login to their site because nobody can remember a password which satisfies all their rules (only other option is to save it to lastpass but that is not available on mobile) I hope that more companies consider this new password policy that is also easy to remember.

sfeng 6y ago
Maybe try 1Password? It is absolutely available on mobile.
- DavideNL 6y ago
  1Password is an awesome app, insanely expensive in my opinion though; Once you get a subscription you're going to be stuck for a while, so at €38/year, for me and my partner, that makes €380 for a 5 year period! For a password manager... Free alternatives would be KeePassXC / Bitwarden / Strongbox (iOS).

hlieberman 6y ago

On the bottom of the page, there's an absolutely galaxy brain take that made me twitch: “A world that uses facial recognition does not look like Hollywood’s Minority Report. It looks like a smarter, more pleasant experience interacting with complex computer security systems to help make a safer world for our friends, our families and our children.” Marios Savvides, director of CyLab’s Biometrics Center

refulgentis 6y ago
I believe his point is comments like this are reductive, and more an indicator of pop culture familiarity than anything substantive about protecting user's privacy. minority report's facial recognition involved swarms of fist-sized flying insect robots invading apartments, and facial recognition on my iPhone allows me to secure my data from the state
- soulofmischief 6y ago
  I walked into a shop once and was casually told the camera system routed to a central database shared with federal intelligence who uses facial recognition to match against terrorist and most-wanted databases. I thought that was a little concerning.
  - Aeolun 6y ago
    Why? Are you a terrorist or in a most-wanted database?
    - soulofmischief 6y ago
      For the last four years my country has had an extremely hostile leader that should dispel all confusion about how easy it is to become ideologically opposed and thus persecuted by your government over a short period of time simply for being a supporter of basic human rights.
      - deleted 6y ago

betwixthewires 6y ago

TL;DR the secure password policy is to use their secure password test, the criteria of which are not divulged.

DavideNL 6y ago
The criteria are divulged, and it's all open source... https://github.com/cupslab/neural_network_cracking https://github.com/cupslab/neural_network_cracking

oefrha 6y ago

I recommend changing the link and title to the actual paper: http://www.andrew.cmu.edu/user/nicolasc/publications/Tan-CCS20.pdf http://www.andrew.cmu.edu/user/nicolasc/publications/Tan-CCS... IMO this accompanying press release is devoid of content and meaning even by typical university PR standards.

rmrfstar 6y ago
Yeah, the whole "backed by science" thing has a weird tinge of religiosity to it. I did notice that the article author has nothing whatsoever to do with the actual research.
- AntiImperialist 6y ago
  Whenever I read that phrase, I instinctively know that they are trying to sell some bs that people would otherwise not even consider because of how little sense it makes.
  - raarts 6y ago
    Just like 'experts say' or 'research suggests'.
    - rmrfstar 6y ago
      "Research suggests" is better. It's an appeal to process, not authority.

kobayashimaru 6y ago

Securely use a compromised pasword cos u dont give a fuck is my policy

deleted 6y ago

[deleted]

Straw 6y ago

This perpetuates the fundamental misunderstanding on what makes passwords strong. In fact, no password itself has any guaranteed entropy and hence strength- only a distribution has this property. Since humans provide such poor randomness, we should never pick passwords at all, but generate them. Research should go to making more memorable generated passwords, looking for the best tradeoff between that and entropy.

nmca 6y ago
I had a (slightly silly) go at tackling this problem via a secure mapping and language-model reranking according to probability of text under urban dictionary - there is a detailed description here if you're curious: (pdf-link) https://n-mca.github.io/work/Nat_McAleese_Arbitrary_Encodings.pdf https://n-mca.github.io/work/Nat_McAleese_Arbitrary_Encoding...
FabHK 6y ago
That fundamental misunderstanding is not a misunderstanding. You can look at individual passwords and estimate their "entropy", such as zxcvbn does, and in fact you need to. Because the distribution that matters is not the one you used to pick the password, but the one that the attacker uses. You could pick from the universe of arbitrary UTF-8 strings of up to 1000 characters (huge entropy), and pull "password" - but that would be a bad password, despite the distribution. Or you could pick randomly from {"password", "09854yngbmoujcr08twnvgje8w6g7bkv,cmxm5^&*9NMF"}, and pick the latter, and it would be a reasonable password, despite carrying only 1 bit of information in the given distribution. > Research should go to making more memorable generated passwords, looking for the best tradeoff between that and entropy. Agreed on that.
- Straw 6y ago
  Although by chance you might pick a good password, you have absolutely no guarantee of the strength unless its generated from a distribution with known entropy. The problem with assuming any particular distribution for the attackers is that they tend to constantly update their attacks as password trends evolve. Random password, picked uniformly from strings up to 1000 characters? Almost certainly at least 900 characters, extremely strong. Probability of picking "password"? Less than the probability you're currently hallucinating, or that there's a bug in your code, or that an attacker guesses your password by pure chance. You can't show that particular string isn't easy to guess- perhaps it follows a common pattern of humans spamming "random" keypresses with far lower entropy than one would expect. Can I show that I could guess something without seeing it beforehand? Probably not. Don't settle for "I couldn't guess this password" when you can get "No one can guess this password".

FabHK 6y ago

So, the end result of that paper is a password-quality-meter like zxcvbn (or presumably better)? (They do reference zxcvbn in the paper: "One of the more accurate password-strength estimators, zxcvbn [34], uses advanced heuristics to output quite reliable password strength estimates at low guess numbers typical of online attacks.")

vimax 6y ago
If I read the paper correctly: They trained a state-of-the-art password guessing NN. They used this to train a second NN to estimate the number of guesses needed by the first NN to guess a given password, and used this second NN as the password meter. A password is resistant to online attacks if it takes more than 10^6 guesses, and resistant to offline if it takes more than 10^14 guesses. After comparing combinations of password requirements, blocklists, and strength requirements, they found that minimum of 12 characters, and a NN estimate of more than 10^12 guesses is the best password requirements for usability and protection from offline attacks. So instead of heuristics for a strong password, they derive the strengths from how many attempts it would take a SotA NN to guess the password.

teetertater 6y ago

Here’s a password strategy I began using that allows me to commit every password to memory while keeping them unique (I don’t trust pw managers): Letters representing the service + Constant text + year + constant ascii E.g for this site it could be "hackblabla2020__#" Then for email it could be "emaiblabla2020__#" Then it also forces me to change it once a year-ish

CJefferson 6y ago
If someone really cared about hacking you, and one of those websites has a clear text password dump (which happens all the time), you are in serious trouble.
- teetertater 6y ago
  I figured if someone really cared about hacking me I'd be screwed anyway. I should add that my most important accounts don't follow this pattern
fingerlocks 6y ago
I hope Constant Text is quite large, because otherwise you just announced the majority of your password to all of your logins. Consider deleting this post?
- teetertater 6y ago
  Thanks for the concern. The examples I gave don't follow the real patterns/orders/Ascii I use