3 ms·

Once that happens, a criminal could notice your password is more of a pattern than a full random password (of typable characters). But in order to do anything

Once that happens, a criminal could notice your password is more of a pattern than a full random password (of typable characters). But in order to do anything beyond hacking the single compromised account, the criminal would have to reverse engineer my algorithm, which, as you said, nobody would bother doing. In addition, the algorithm is complex enough that it would be hard for a casual observer to distinguish the embedded domain name from general password randomness. Your scheme ideally would rely on not tying all your accounts together with the same email address That is true, but this only becomes relevant when an attacker is manually searching for my email across multiple password dumps (as opposed to an automated credential stuffing attack), which means I’m being specifically targeted.

kingaillas 4y ago
>which means I’m being specifically targeted I don't know about that. Various episodes of Darknet Diaries make it clear stolen password databases are searched for any matching email accounts, which of course depends on the motivation level of the attackers. I suspect a simple "check all emails in this one database for a match in the other database" isn't that large of a hurdle. Your average CS101 class might include an extract emails, sort, merge-compare type of assignment. And yes, like so many others here, you apparently have the goldilocks algorithm. Easy/simple enough for you to generate on the fly yet secure enough to resist all but nation-state attackers. To that I say - congrats. But the GENERAL advice to the public at large is that the rest of humanity isn't as awesome as you are, and THEIR password generating algorithms of generated characters plus domain name are easily deduced from a single sample, thus making password managers far far superior to protecting against actual real world threats ("crappy website has lousy security and got breached through zero fault of mine") and not the frequently imagined threats ("I am the target of a concerted effort by extremely sophisticated attackers with infinite time/budget").

kingaillas 4y ago

>which means I’m being specifically targeted I don't know about that. Various episodes of Darknet Diaries make it clear stolen password databases are searched for any matching email accounts, which of course depends on the motivation level of the attackers. I suspect a simple "check all emails in this one database for a match in the other database" isn't that large of a hurdle. Your average CS101 class might include an extract emails, sort, merge-compare type of assignment. And yes, like so many others here, you apparently have the goldilocks algorithm. Easy/simple enough for you to generate on the fly yet secure enough to resist all but nation-state attackers. To that I say - congrats. But the GENERAL advice to the public at large is that the rest of humanity isn't as awesome as you are, and THEIR password generating algorithms of generated characters plus domain name are easily deduced from a single sample, thus making password managers far far superior to protecting against actual real world threats ("crappy website has lousy security and got breached through zero fault of mine") and not the frequently imagined threats ("I am the target of a concerted effort by extremely sophisticated attackers with infinite time/budget").