4 ms·

I gave up on password managers. I used KeePass for a long time, but now I use a single password with a few added characters that I calculate in my head based o

I gave up on password managers. I used KeePass for a long time, but now I use a single password with a few added characters that I calculate in my head based on the domain name of the service.

dheera 6y ago
Your method is extremely vulnerable to a scenario where one of the several websites you use stores plaintext passwords, gets hacked, and now someone knows most of your email/bank account password except for a "few added characters", which can be irritated in a very short time. Your entire password entropy is effectively reduced to the few added characters. On that note though, I use an actual cryptographic hash of a master password plus a concatenated domain. The resulting password to any specific site is leakable without revealing the master password. https://github.com/dheera/scripts/blob/master/passenter https://github.com/dheera/scripts/blob/master/passenter
- LordAtlas 6y ago
  How does this method work for sites that require password changes every X days or sites that need a password change because they had a data breach?
  - dheera 6y ago
    I have a stored parameter "n" that just increments the number of irritations of PBKDF2. That's a lot less to deal with than the amount of state in a traditional password manager, and I'm much less worried about losing it since it's likely I can estimate n for most sites even if I don't have it with me.
  - klyrs 6y ago
    Forced rotation always results in users using this "add a bit of junk" strategy. Both this strategy, and password rotation, are weak for that reason. And the whole point is that a breach of one site may expose almost-your password for many more sites.
  - simonebrunozzi 6y ago
    You could add a date (202101 for YYY-MM) to the string (domain URL or service name) before you apply your custom "hash" function.
    - LordAtlas 6y ago
      But then you would need to remember the date you changed your password for each site that needs it.

I gave up on password managers. I used KeePass for a long time, but now I use a single password with a few added characters that I calculate in my head based on the domain name of the service.

dheera 6y ago

Your method is extremely vulnerable to a scenario where one of the several websites you use stores plaintext passwords, gets hacked, and now someone knows most of your email/bank account password except for a "few added characters", which can be irritated in a very short time. Your entire password entropy is effectively reduced to the few added characters. On that note though, I use an actual cryptographic hash of a master password plus a concatenated domain. The resulting password to any specific site is leakable without revealing the master password. https://github.com/dheera/scripts/blob/master/passenter https://github.com/dheera/scripts/blob/master/passenter

LordAtlas 6y ago
How does this method work for sites that require password changes every X days or sites that need a password change because they had a data breach?
- dheera 6y ago
  I have a stored parameter "n" that just increments the number of irritations of PBKDF2. That's a lot less to deal with than the amount of state in a traditional password manager, and I'm much less worried about losing it since it's likely I can estimate n for most sites even if I don't have it with me.
- klyrs 6y ago
  Forced rotation always results in users using this "add a bit of junk" strategy. Both this strategy, and password rotation, are weak for that reason. And the whole point is that a breach of one site may expose almost-your password for many more sites.
- simonebrunozzi 6y ago
  You could add a date (202101 for YYY-MM) to the string (domain URL or service name) before you apply your custom "hash" function.
  - LordAtlas 6y ago
    But then you would need to remember the date you changed your password for each site that needs it.