My security policy is based on the most common data breaches, where an adversary obtains a big list of email/passwords and just tries them on a handful of sites

My security policy is based on the most common data breaches, where an adversary obtains a big list of email/passwords and just tries them on a handful of sites (Facebook, Twitter, etc), throwing out the records that don't work. Sure, it's technically possible to decipher the algorithm[0] I use to generate new passwords, but that's not what I'm protecting against. If someone is trying to attack a specific person, there are much more effective ways[1]. [0]: For example, if my password for HN is "1y2c3o4m5b!$", you could sit down and figure out my reddit password. [1]: https://gizmodo.com/how-i-lost-my-50-000-twitter-username-1511578384 https://gizmodo.com/how-i-lost-my-50-000-twitter-username-15...