3 ms·

If you make your base password "[X]" then for logging into facebook you can use "[X]facebook" and gmail could be "[X]gmail" etc. If I did this, I would give Pa

by uvdiv 14y ago

If you make your base password "[X]" then for logging into facebook you can use "[X]facebook" and gmail could be "[X]gmail" etc. If I did this, I would give Paul Graham access to my GMail, Facebook, and online banking accounts -- they'd all be trivially derivable from my HN password, which he has (in principle). No thanks.

jetti 14y ago
To be fair, most people already do this anyways by using passwords multiple times. There are also two memory banks in a yubikey so you can set two different keys and alternate them using the schema I put forth above. On top of that, you don't need to use the site name, it is up to you what to chose, you can use something incredibly simple for each site and a simple password turns into a not so simple password.
- sk5t 14y ago
  Negatory on this approach... one of the good uses for the Yubikey is TOTP[1][2] -- and TOTP must not share any key material across sites, rather, each site has its own seed. [1] http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al... [2] http://zetetic.net/software-onetime http://zetetic.net/software-onetime Disclaimer: my employer makes OneTime.
- uvdiv 14y ago
  To be fair, most people already do this anyways by using passwords multiple times. At least they have no illusion of security. The scheme you showed provides lots of illusion, and zero security. This matters because, for the same effort, users can get much stronger security, even a cryptographic guarantee of password independence. (Leaked site passwords yield zero information about other site passwords, even if they're derived from the same root). But they will not seek out these solutions if they are mislead into using broken schemes instead. There are also two memory banks in a yubikey so you can set two different keys and alternate them using the schema I put forth above. That's still terrible.

by uvdiv 14y ago

jetti 14y ago

To be fair, most people already do this anyways by using passwords multiple times. There are also two memory banks in a yubikey so you can set two different keys and alternate them using the schema I put forth above. On top of that, you don't need to use the site name, it is up to you what to chose, you can use something incredibly simple for each site and a simple password turns into a not so simple password.

sk5t 14y ago
Negatory on this approach... one of the good uses for the Yubikey is TOTP[1][2] -- and TOTP must not share any key material across sites, rather, each site has its own seed. [1] http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al... [2] http://zetetic.net/software-onetime http://zetetic.net/software-onetime Disclaimer: my employer makes OneTime.
uvdiv 14y ago
To be fair, most people already do this anyways by using passwords multiple times. At least they have no illusion of security. The scheme you showed provides lots of illusion, and zero security. This matters because, for the same effort, users can get much stronger security, even a cryptographic guarantee of password independence. (Leaked site passwords yield zero information about other site passwords, even if they're derived from the same root). But they will not seek out these solutions if they are mislead into using broken schemes instead. There are also two memory banks in a yubikey so you can set two different keys and alternate them using the schema I put forth above. That's still terrible.