3 ms·

To make unique passwords for each site I use a simple formula on the domain name that I can work out in my head and append it to a "master" password. An example

To make unique passwords for each site I use a simple formula on the domain name that I can work out in my head and append it to a "master" password. An example formula could be "take the last 2 letters of the domain name and shift them 1 letter forwards". This means your passwords always have different hashes, which will reduce brute force attacks. Depending on the complexity of your formula and how much time the attacker has, it may not be possible to work out your GMail password from your Sony one. Another password tip I read was moving your hands up (or right) 1 row when typing. For example, "a" becomes "q". This adds an extra step to creating a dictionary for an attack so should secure your password a bit.

duncanj 15y ago
The problem with this approach is that you get exposed when a website stores their passwords as plaintext. Someone who was smart enough to notice the pattern in your formula could then use that info to get at your other accounts.
- dave1010uk 15y ago
  Very true, though the ease of breaking this would vary widely based on the formula and the master password. If you knew my Facebook password was "CheeseFace" then you'd guess that my Twitter one was "CheeseTwit" but if you knew my Facebook password was "rsuifhskjcv" then you have no idea that my Twitter one was "rsuifhsksuw".
- bigiain 15y ago
  Did you notice one of the passwords mentioned as being found in readily available rainbow tables was 1qazZAQ! - the leftmost column of keysn a keyboard down then up-with-shift-held-down. That's an indication that the password cracking community is perfectly aware of "keyboard pattern" passwords.
  - dave1010uk 15y ago
    It makes sense that attackers are likely to know the steps we take to make secure passwords but a password that's been "keyboard shifted" would be slightly more secure as it is an extra variation for a dictionary to include.

duncanj 15y ago

The problem with this approach is that you get exposed when a website stores their passwords as plaintext. Someone who was smart enough to notice the pattern in your formula could then use that info to get at your other accounts.

dave1010uk 15y ago
Very true, though the ease of breaking this would vary widely based on the formula and the master password. If you knew my Facebook password was "CheeseFace" then you'd guess that my Twitter one was "CheeseTwit" but if you knew my Facebook password was "rsuifhskjcv" then you have no idea that my Twitter one was "rsuifhsksuw".
bigiain 15y ago
Did you notice one of the passwords mentioned as being found in readily available rainbow tables was 1qazZAQ! - the leftmost column of keysn a keyboard down then up-with-shift-held-down. That's an indication that the password cracking community is perfectly aware of "keyboard pattern" passwords.
- dave1010uk 15y ago
  It makes sense that attackers are likely to know the steps we take to make secure passwords but a password that's been "keyboard shifted" would be slightly more secure as it is an extra variation for a dictionary to include.