If all accounts would have sane restrictions on the password it would become trivial to have something both secure and convenient. I have been looking for a system that allows me to: 1. Does not require me to remember an absurd amount of information. 2. Allows me to login to services, even from other devices. 3. Has a unique password for each service (so that it is not disastrous if one password leaks).
We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would only require you to pick and remember a strong master password.
BUT its safe, because unless YOU are the target of the attack, the contents of your random slip of paper on your desk, or the password protected one note file on your dropbox, or the encrypted pwsafe3 file on your usb stick are outside of the reach of some bad actor trying to get ALL of the passwords, not just YOUR password.
Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.
If you aren't the one under attack, and you still create different passwords for each service, the method of offline password storage (be it a spread sheet, a password manager, or a sticky note) are all similarly-ish safe.
It may be you're working in the one environment where the master password + derived password scheme + counter scheme would be an improvement, but the above objection is why it doesn't work well for most users.
Is it secure? No. But if you work at a place where SSO isn't a thing in 2018, it's not secure anyway.
This is bad security advice. Don't this if at all possible.
This has been tried. While it initially sounds appealing, it is a monumentally terrible idea.
* You need software to implement the scheme.
* Rotation is a problem, you need a counter for state
* Different services have widely different password rules which are additional state
* If a site stores password data in cleartext or weakly hashed, your master password/passphrase can potentially be cracked
* People choose passphrases just as badly as they choose passwords
Just write your passwords down. Maybe leave a few characters off or don't label them.
It all comes down to the threat model you are defending against. The threat model I'm defending against is automated attempts to catch me reusing the same password with different accounts.
Even if you were defending against a motivated actor putting human eyes on your passwords, something like`XXXXXXsXXXXXXsssXX` where the X are reused across sites and the s is a derived, site-specific chunk is a) as good as completely random until your adversary is manually correlating multiple leaked passwords for you and b) not trivially obvious to derive once they are correlating multiple leaked passwords.
This is a thing that is done, and even automated. If you have a couple password dumps, checking levenshtein distance between them is not hard.
How is that reasonable? If you make a case that restricting password managers lowers security, could you possibly change it?