4 ms·
> Step 3: Diversify your social passwords for added security > "My 1st Password!: Twitr" > "My 1st Password!: Fb" > "My 1st Password!: Redd" This is a
by Zikes 14y ago
> Step 3: Diversify your social passwords for added security
> "My 1st Password!: Twitr"
> "My 1st Password!: Fb"
> "My 1st Password!: Redd"
This is a terrible technique, because it's only marginally better than using the exact same password everywhere. It shares the same weakness in that as soon as your password is compromised in one place, it's as good as compromised everywhere else.
- jholman 14y agoYes and no. If someone is attacking you personally, yes. If someone attacks a group that includes you, breaks one of your passwords, and posts a dump on the internet, yes. But if someone gets some password database, bruteforces all the passwords under 20 characters, and now has a username-to-password map with a million entries.... you're probably safe from that attacker using your username/password on other services. So I'd say that it's better than "marginal". So it depends on what attack scenario you're defending against. Which is true for all safety judgements.
- marshray 14y agoIn Soviet Russia, the attacker gets chosen by you!
- ay 14y agoA simple way to make this a bit harder: stty -echo; echo `read | sha1sum` LittleBitOfSalt | sha1sum | cut -c 1-40 | pbcopy; stty echo Then paste whatever ends up in the clipboard as your password. pbcopy is MacOS X specific I think, but IIRC there was similar way to shove stuff into clipboard on linux. Else you end up with (1) password on the screen (2) immense pain typing 40 senseless hex chars :-) Both Intel's contest and the test at http://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.html http://dl.dropboxusercontent.com/u/209/zxcvbn/test/index.htm... mentioned elsewhere in this thread seem to be relatively happy with the result.. The fully random passwords with the password manager are probably better though...