Hacker News Reader

Comment by have_faith | Hacker News Reader

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website.

This way I don't ever remember a password, I just remember the system.

View on HN

Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...

In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would).

If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.

This is true. I don't think the system is obvious unless you had multiple passwords, on top of that it's not immediately obvious that there is a system in the first place from looking at the plaintext password.

What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.

Your master password shouldn't really be something that's going to be in either a dictionary, or brute forcible. Nobody is going to "get" it unless you make it insecure. If you're using their sync services, however (especially LastPass), you're more vulnerable to phishing attacks, and the vault can potentially be stolen and crack attempts run offline. However, both services use a heavy level of encryption that requires the passphrase to unlock, so as long as that's not dictionary based or brute forcible, you're totally fine.

They would also need access to the machine which you have your vault stored on which would be your laptop and your phone and nothing else.

How do you deal with websites that won't let you use >8char or certain characters?

I use this same method, but my method will often generate special characters, and AWS as an example, and several others (apparently following AWS' lead) won't let you use those. (Any punctuation not on the shift-numbers row of USA keyboards are not considered legit for password use)

I still mostly use this system, and given my lucky memory I can memorise the exceptions, but I doubt a vast majority of the population could follow my example.

I basically just have a system for altering the generated passwords based on the specific site requirements. For instance if it requires a max num of chars then I will just chop off the password at that amount. And similar systems for other requirements.

When one of the sites you use gets breached, you'll want/need to change your password and won't be able to use the same single algorithm. This will throw things of as you won't be able to use a single algorithm. Sure you could not use two. But you'll need to remember what sites use which one.

It's a pretty shitty algo if someone can reverse engineer it with a sample of 1...

not to mention forced password recycling.

Reply on news.ycombinator.com