3 ms·
For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. Tha
by simonbarker87 5y ago
For people who have to change their password regularly I suggest just adding the month and year in numbers at the end of whatever password they like to use. That way there is a clue in the current month and year as to what their password probably is should they forget
- harryvederci 5y agoIf a hacker found an old password of yours, the month an year would be a pretty easy indictor of what to try next, right?
- rgoulter 5y agoIt's a trade-off of convenience vs security. If you're worried a password will leak, how frequently should you rotate it to maintain security? e.g. Even rotating yearly still seems a chore if you do it for websites you don't frequently visit (such as sites you made 1 order from). The "add YYMMDD" or whatever is a way of working around a policy which automatically enforces a more frequent rotation than you want.
- KMnO4 5y agoMy security policy is based on the most common data breaches, where an adversary obtains a big list of email/passwords and just tries them on a handful of sites (Facebook, Twitter, etc), throwing out the records that don't work. Sure, it's technically possible to decipher the algorithm[0] I use to generate new passwords, but that's not what I'm protecting against. If someone is trying to attack a specific person, there are much more effective ways[1]. [0]: For example, if my password for HN is "1y2c3o4m5b!$", you could sit down and figure out my reddit password. [1]: https://gizmodo.com/how-i-lost-my-50-000-twitter-username-1511578384 https://gizmodo.com/how-i-lost-my-50-000-twitter-username-15...
- simonbarker87 5y agoOh yeh it’s not ideal but the alternative is my relatives having a post-it note nearby with their current password written down - I feel this is a lesser of two evils