2 problems; 1) Some sites place rules on the password. A bank I used limited passwords to 6 characters! Can believe someone thought that was a good idea. 2) I

2 problems; 1) Some sites place rules on the password. A bank I used limited passwords to 6 characters! Can believe someone thought that was a good idea. 2) If you use this on random sites someone might pick up the format quite easily if they are targeting you. I'd suggest using layers of 'root' so random sites you sign-up use one root (e.g. HN), mid-security sites use another root (e.g FB), and high need for security sites use a third root (Financial). I do something like this to limit risk and it's not too hard to remember. Regarding the single point of failure which I believed previously was a problem with password managers, Voxic11 explained otherwise a couple months back in a previous thread: "LastPass and other password services don't actually store your information in any way they can read them. What they do is store the password information as a encrypted blob and the public key derived from your password. When you "log in" you actually are running the key derivation function on your password locally then signing a message with your private key and sending that to Lastpass. When they receive the signed message they check it against your public key and if it passes they send you your password information. Which you then decrypt clientside. So anyone who compromises lastpass gets nothing except a bunch of encrypted blobs and public keys. The only way to get at your lastpass information is to retrieve the unencrypted copy off your computers memory, but if a hacker can do that they can just steal your passwords as your type them in anyways."