3 ms·
>If you do it automatically and in a way that has high entropy the result is a lot less memorable. I find it just as easy to remember correcthor_sebatTerystapl
by thesuitonym 2y ago
>If you do it automatically and in a way that has high entropy the result is a lot less memorable.
I find it just as easy to remember correcthor_sebatTerystaple, and it effectively changes the attack from guessing which four words were used from a well known dictionary.
- nullc 2y agoAttackers have made extremely good models of mangling that humans perform on passwords, so this kind of change just adds whatever bits of entropy there are in your selection of mangling approaches. It's almost certainly less than you think. It might help to understand what people have done here: There have been absolutely gigantic plaintext password leaks. Armed with plaintext passwords and collections of very good 'dictionaries' (might not actually be dictionaries) attackers design rules to turn the dictionary into as many passwords as possible without duplication.