4 ms·
Hi! As you are an expert in the domain, do you know if my method to generate personal password seems secure? Typically, instead of memorizing a lot of random p
by yogsototh 15y ago
Hi! As you are an expert in the domain, do you know if my method to generate personal password seems secure?
Typically, instead of memorizing a lot of random password, I memorize only one password and for each website I use the password:
sha1(password|domainname)
Until here nobody give me a clear answer, and therefore I assume it is secure while not any flaw is discovered.
And more precisely, I use
sha1(password|number|domainname)
because, if I fear my password was discovered, I change it by incrementing the number.
I would be very grateful if you mind answer my question. Thanks!
- JoachimSchipper 15y agoThat's vulnerable to a length extension attack: sha1(passwd|am) can be used to derive sha1(passwd|amazon). (See Wikipedia for a discussion.) Don't try to get clever, just use random passwords.
- yogsototh 15y agoThank you so much! It is exactly what I was looking for.