Hacker News Reader

Comment by 0x45696e6172 | Hacker News Reader

Because it is better than the alternative.

Pick two:

  (1) memorizable passwords
  (2) bruteforce-resistant passwords
  (3) account-unique passwords.

The best tradeoff for me is (2)+(3) sacrificing (1), so I use a local password manager (named 'pass'). That said, I would never trust a 3rd party like LastPass.

View on HN

Choose a complex base password + a memorizable _algorithm_ that combines (eg) domain names with the base password. That satisfies all of your requirements, and it's not super difficult to create an algorithm that is easy to perform mentally and hard to reverse.

I started doing this in college, and it's been super easy to keep up and my passwords are pretty secure.

I did this before using a password manager. I found that it does work but it's still a pain.

For example, what do you do when you're forced to change a password? You need to remember that this website doesn't follow the rule. There's also the case of password being used by several websites with different names or urls, you need to remember which is the base one.

Also it's really convenient to store other things than passwords in the password maanger. Like some notes, your customer number, which email you signed up with, some PIN they give you...

Not being able to do #1 can be a feature. If you can’t easily login to your accounts it adds just the right amount of friction to buying things online.

Indeed, made worse/better by the need to fetch my Yubikey to sign in. Likewise how Firefox Focus helped me to kick my Facebook habit.

Reply on news.ycombinator.com