> once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula. It's true that's a hypothe

> once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula. It's true that's a hypothetical attack vector. In practice, so few people use this approach that you're not going to see a general-purpose deployable attack suite based on this principle. It'd be useful for a targeted attack, but if you're under a persistent, targeted threat there are better tools (spear-phishing, social engineering, physical compromise, etc.).