5 ms·

this sort of thing is why I append the name of the website + a unique identifier + password, so that I don't have to bother changing my password during such non

this sort of thing is why I append the name of the website + a unique identifier + password, so that I don't have to bother changing my password during such nonsense, ugh.

TedDoesntTalk 4y ago
Append it where?
- endisneigh 4y ago
  e.g. password to facebook would be: facebook.com$293MyPasswordYouKnowIt!!123 password to gmail would be mail.google.com$113MyPasswordYouKnowIt!!123 only annoying thing is that the passwords are long. I guess it's secure, though. edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.
  - kangalioo 4y ago
    How do you remember the unique identifier?
    - endisneigh 4y ago
      it's deterministic, but obviously I can't tell you the secret ;) that being said there are a lot of things you could use. you could use information in the whois, you could use the birthdate of the founder of the site, etc. personally I believe people should use the same password for all sites and then something similar to what I described. though I use a password manager, I do always feel nervous about the implementation leaking out details
  - zenexer 4y ago
    That’s not secure at all. Eventually, some website you use is going to get hacked. They’ll have stored passwords as plaintext. From there, anyone who wants to hack any of your accounts knows your password format. It’s going to be obvious to them that they just need to replace the domain.
    - endisneigh 4y ago
      how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information. of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy sites. for what it's worth my format isn't really as described, but it is similarly deterministic, but not visually so. the cipher is basic enough to do in your head but complicated enough that you wouldn't know from a glance a real password example for your scrunity: m0m2a2yiplagsosowgolredd1o2t3c!o!m2 steps: m a i l g o o g l e d o t c o m strategy zip secret mypassword123!! offset (publicly determinable) 0 unique: 2022 m0m2a2yiplagsosowgolredd1o2t3c!o!m2 i use a password manager so the long text generally is irrelevant. the main reason I do this is because I don't feel comfortable needing my password manager. I like being able to figure out my actual password completely independent of a phone or internet or app. the strategy depends on how sensitive the app is (strategies include: zip, append, vowel-zip, no-vowel-zip, num-zip, all the same but with a reverse-offset). unique is usually something like when I joined, or something determinable from the site and my head. all of this seems much more complicated than it is. once you understand you could calculate the password in your head in a couple seconds.
      - aliqot 4y ago
        you're putting a lot of confidence in an effective password length of 3
        endisneigh 4y ago
        you're thinking too much about the specific example and not the general point, but I edited the parent comment with an actual example edit: oh, I did say append so I see why you'd think that. that's my bad. what I meant was include
        danparsonson 4y ago
        By your example, your passwords are a set of fixed or knowable data, plus a unique identifier that in your examples is three characters long. Therefore knowing one of your passwords gives all except three characters of every other password, thus making your effective password length three characters (substitute the actual length of your unique identifier if it's more than three).
  - Bud 4y ago
    This means that if a breach reveals more than one of your passwords, the pattern is easily recognized and you just made ALL your passwords extremely weak. Not a great idea.
    - endisneigh 4y ago
      this is true, yes. fwiw what I do is more complicated than an append. I'll edit it to say "include", which is more accurate.
  - int_19h 4y ago
    This scheme as described is not secure, but with one more step it can be. Luckily, that step has already been automated: https://www.lesspass.com/ https://www.lesspass.com/
    - TedDoesntTalk 4y ago
      Prior art: http://PasswordMaker.org http://PasswordMaker.org also with apps, browser extensions, command line tools, and many forks.
branon 4y ago
Do this instead https://spectre.app/ https://spectre.app/
- endisneigh 4y ago
  oh that's cool. what I do is similar except simpler, much so.
- slivanes 4y ago
  How does one handle password rotation requirements?
- encryptluks2 4y ago
  Doesn't that make your passwords predictable? If you use the same secret for every domain and now if an attacker figures out your one secret then they would be able to find out all your passwords.
  - scarab92 4y ago
    How is that different from any other scheme which uses a master password?
    - encryptluks2 4y ago
      A master password is at least generating random passwords though and encrypting the passwords themselves. Let's say your master password gets compromised, but not the password database itself... then attackers would still have no way to access your other passwords. With the method being described, simply obtaining the "secret" makes other passwords known without even needing access to the password database itself.
- aix1 4y ago
  What do you when a generated password doesn't meet a web site's requirements (on length, character classes etc)?

this sort of thing is why I append the name of the website + a unique identifier + password, so that I don't have to bother changing my password during such nonsense, ugh.

TedDoesntTalk 4y ago

Append it where?

endisneigh 4y ago
e.g. password to facebook would be: facebook.com$293MyPasswordYouKnowIt!!123 password to gmail would be mail.google.com$113MyPasswordYouKnowIt!!123 only annoying thing is that the passwords are long. I guess it's secure, though. edit: see child post for clarification. I do something above for spammy sites, but for something like gmail I probably wouldn't do that.
- kangalioo 4y ago
  How do you remember the unique identifier?
  - endisneigh 4y ago
    it's deterministic, but obviously I can't tell you the secret ;) that being said there are a lot of things you could use. you could use information in the whois, you could use the birthdate of the founder of the site, etc. personally I believe people should use the same password for all sites and then something similar to what I described. though I use a password manager, I do always feel nervous about the implementation leaking out details
- zenexer 4y ago
  That’s not secure at all. Eventually, some website you use is going to get hacked. They’ll have stored passwords as plaintext. From there, anyone who wants to hack any of your accounts knows your password format. It’s going to be obvious to them that they just need to replace the domain.
  - endisneigh 4y ago
    how would they figure out the unique identifier? couldn't you say the same thing about using an arbitrarily unique password and then a password manager. if your password manager is hacked then they'd get the encrypted passwords for all sites you use along with all the personal information. of course, you'll say, don't use a crappy password manager. and that's correct. same reason I use a separate format for sketchy sites. for what it's worth my format isn't really as described, but it is similarly deterministic, but not visually so. the cipher is basic enough to do in your head but complicated enough that you wouldn't know from a glance a real password example for your scrunity: m0m2a2yiplagsosowgolredd1o2t3c!o!m2 steps: m a i l g o o g l e d o t c o m strategy zip secret mypassword123!! offset (publicly determinable) 0 unique: 2022 m0m2a2yiplagsosowgolredd1o2t3c!o!m2 i use a password manager so the long text generally is irrelevant. the main reason I do this is because I don't feel comfortable needing my password manager. I like being able to figure out my actual password completely independent of a phone or internet or app. the strategy depends on how sensitive the app is (strategies include: zip, append, vowel-zip, no-vowel-zip, num-zip, all the same but with a reverse-offset). unique is usually something like when I joined, or something determinable from the site and my head. all of this seems much more complicated than it is. once you understand you could calculate the password in your head in a couple seconds.
    - aliqot 4y ago
      you're putting a lot of confidence in an effective password length of 3
      - endisneigh 4y ago
        you're thinking too much about the specific example and not the general point, but I edited the parent comment with an actual example edit: oh, I did say append so I see why you'd think that. that's my bad. what I meant was include
        danparsonson 4y ago
        By your example, your passwords are a set of fixed or knowable data, plus a unique identifier that in your examples is three characters long. Therefore knowing one of your passwords gives all except three characters of every other password, thus making your effective password length three characters (substitute the actual length of your unique identifier if it's more than three).
- Bud 4y ago
  This means that if a breach reveals more than one of your passwords, the pattern is easily recognized and you just made ALL your passwords extremely weak. Not a great idea.
  - endisneigh 4y ago
    this is true, yes. fwiw what I do is more complicated than an append. I'll edit it to say "include", which is more accurate.
- int_19h 4y ago
  This scheme as described is not secure, but with one more step it can be. Luckily, that step has already been automated: https://www.lesspass.com/ https://www.lesspass.com/
  - TedDoesntTalk 4y ago
    Prior art: http://PasswordMaker.org http://PasswordMaker.org also with apps, browser extensions, command line tools, and many forks.

branon 4y ago

Do this instead https://spectre.app/ https://spectre.app/

endisneigh 4y ago
oh that's cool. what I do is similar except simpler, much so.
slivanes 4y ago
How does one handle password rotation requirements?
encryptluks2 4y ago
Doesn't that make your passwords predictable? If you use the same secret for every domain and now if an attacker figures out your one secret then they would be able to find out all your passwords.
- scarab92 4y ago
  How is that different from any other scheme which uses a master password?
  - encryptluks2 4y ago
    A master password is at least generating random passwords though and encrypting the passwords themselves. Let's say your master password gets compromised, but not the password database itself... then attackers would still have no way to access your other passwords. With the method being described, simply obtaining the "secret" makes other passwords known without even needing access to the password database itself.
aix1 4y ago
What do you when a generated password doesn't meet a web site's requirements (on length, character classes etc)?