Hacker News Reader

Comment by chris_st | Hacker News Reader

I really like Password Chart[1] as my "password encryption" scheme, since it gives me nice long wacky phrases out of something memorable, per-site.

[1] http://passwordchart.com

View on HN

Except until a couple of sites leak their plaintext passwords, and the attacker can start piecing information together. Bob@foomail.com's PW on Yahoo.com was ZuBrDfPgPg, and on Patreon.com SkBrOxPdGqPgLu. Any chance his PW for Therapy.com might be OxDfGqPdBrSkZu?

Such attack is more attractive and more effective the more people use this specific method.

I highly, highly doubt that anybody is going to do that as a general attack vector. Computers change, but people are people and are not like, in great numbers, to suddenly start having good passwords, just as they are not likely to suddenly start exercising.

You are essentially relying on security through obscurity, it might work but it fails to add security when viewed through Kerckhoffs's principle.

True. However, the article here is talking about bulk encryption of thousands of passwords, and how "ordinary" word sets are easy to break.

I think the "usual" case is that hackers want to get as many passwords as possible, and so singling out an individual for analysis is probably not worth the time, unless you're an "individual of interest" for some reason.

Here you are using fixed passphrase and site name as the password, resulting in monosubstitution cypher, which is where the insecurity comes from.

If you use site name as the passphrase and fixed password ("password" below) instead, you end up with:

  yahoo.com:   dXgvRMjjHQvRQFvSa
  patreon.com: UdKiiXVxrCRjYe
  therapy.com: KFXUMnMnSrJLIjaB

That seems quite a bit better (though you do lose ability to print the chart for off-line use). If an attacker knows your 3 plain text passwords and suspects that you use passwordchart.com, you are still in trouble.

Reply on news.ycombinator.com