Hacker News Reader

Comment by Waterluvian | Hacker News Reader

I use an algorithm. In short:

1. Memorize some base password 2. Memorize a way in which you mutate that password based on the name/type/other of the service logging in to.

Eg. Hunter2 becomes eHunterG8 Because my example algorithm cares about Google's first letter, length, and service type: email.

It allows every password to be different but you only memorize two things. It is meant to be a "good enough" solution that is much better than using the same password for everything, but naturally is worse than using significantly different passwords.

I've used this for a few years to great success. The one issue I have is I sometimes have to try multiple times when one account is many types of services.

View on HN

Doesn't this compromise all of your passwords if one of your passwords is discovered? Sure, it would take a bit of thinking to realize what each part refers to and even realize that your password has some sort of generation algorithm, but it would be a bit more secure to hash that password in some way.

That's why I like using LessPass (even though people talk a bit of shit about it whenever it's mentioned on HackerNews). I have a single master password, the rest of my passwords aren't compromised if I accidentally expose one of them, and I can log in to any site from any device with a browser. Of course, use 2FA when you can, but it's nice to have a secure first layer of defense.

It’s very unlikely anyone will take the time to figure out your pattern unless you’re a high value target. If your password just gets exposed as part of a credential dump among 100 million others then the thieves will automate their attempts to try your password other places and it will fail.

If you’re a high value target then you shouldn’t do this

> Doesn't this compromise all of your passwords if one of your passwords is discovered?

I've been trying to understand password managers for a while. My workplace forces us to use one.

But what you've said doesn't make sense. If your "master password" used in the password manager is discovered, then all your passwords are compromised.

If my laptop or phone gets stolen and someone knows the password from my password manager, then I'm done for.

I choose to follow the algorithm approach too. Even though it's BS.

Yes, but that master password should a) be incredibly secure (mine is longer than 32 characters) b) only be used for your password manager and nothing else. If, instead, you reuse a password in several places, you're only as secure as the weakest link in that chain.

I run lastpass, I only use a unique password for that application. I also rotate that password every few months.

I also have it set to 2FA with google authenticate, so I need to have my phone everytime I log in. It takes longer to login but its worth it

So even if my password were compromised by a keylogger / brute force, you would still need to have access to my phone.

I don't use lastpass on my phone so that's not a nonissue for me. I don't link my phone to my computer at all (airdroid, teamviewer, etc). You would need to have

- My master lastpass password

- My unique phone password and my phone

Both events are kind of unlikely to happen. I worry more about lastpass leaking passwords than me being hacked at any point, since this is the major disadvantage of using lastpass over keepass.

lastpass is nice since I can just make autogenerated throwaway passwords and have a way to take notes on passwords I change over time

You can always enhance the algorithm. For example, use multiple base password, and arrange them based on the servicename. So hunter2 for everything that starts with h or a-c or a-k or with 5 characters. It's your choice how complicated it becomes. Additionally you can mutate the servicepart. Like break it up every n characters, or every syllable and add some service-specific value in. Maybe use the lenght of the servicename multiplied with the number of syllables plus 4. You could also use a random characterstring, lets say the ones from numberrow, and calculate entrys whith those numbers. Like, move by n syllables for every char you add. It's not really hard to make a rather complicate algirithm with the tools you have around you. It's just cumbersome to remember and execute it in case you need it. So unless you really fear to be personal targeted, it's not worth the pain.

Lesspass is the bomb and the way forward. Never had an issue with it and never had to give any internet bassed app or distrubted app my "master password/s". So strongly recommend.

I do basically the same thing, and have for years also. My only frustration with this is that with some sites, due to arcane password restrictions, the algorithm either isn't implementable, or is only implementable in such a way I won't remember. So 90% of the time the strategy works great, and in 10% of the time it fails due to idiosyncracies of the sites involved.

I hate the stupid restrictions sites place on passwords. There should be almost no restrictions.

I have the same issue. My full password is over 20 characters, but some websites restrict to less than that or don't accept the special character that I use.

I have the exact same issue, mine also being over 20 characters which used to be above the length limit on a Microsoft account used to be 16 characters, so glad they changed that

I take that as a warning sign not to use such a site.

re: most banks

The Algorithm is a great solution - breaking the pattern would require password leaks from 3-4 different sites, and a human to spend time puzzling over it. For automated bots the passwords look unique.

What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to?

> What's your solution for annoying sites that require changing your password every 3-12 months, and not reusing previous passwords? If eHunterG8 becomes eHunterG9 and then eHunterG10, how do you remember the number you are up to?

Good question. I just start with 2 (yes, that's weird) and then increment every time or choose the symbol so I eventually exhaust. This is the same question for unique password per different types/groups of websites. The good thing is more websites have abandoned the annoying security question/answer when it comes to forgot password/forgot username. Just straight to SMS/email. For example I cannot remember my cable provider's online account password. The policy is just ridiculous, so I use "forgot password" every single time. Email only, quick and simple.

Please for everyone reading this - please abandon security questions as a requirement and stop being so hard on password requirement such as limiting the length (Twilio I am looking at you, yes). Just ask for a long password and give hints to users how to choose a good password. While the argument for complex password is to increase the search entropy, let's spend more time on securing your server and mitigating common attacks. Users will probably just append a number. So "myAwesomePassword$" is easy to try once "myAwesomePassword" is compromised from another service. Educate your users.

Let user be responsible; I have my "secure" complex rules for password, let me be in control, I don't want to bend to meet your requirement.

Another alternative is always ask for a one-time password (but a lot of users will find that very inconvenience). Choose one.

Ehh. Any password cracker worth their salt would be able to use rules to break hashes created by "The Algorithm", especially easier once the base word has been figured out or supplied by a single plain-text leak.

Yes, the algorithm is breakable with a few examples to figure out the base word and the pattern. But this requires human attention at your personal algorithm.

Unless you are enough of a celebrity or public figure to be personally targeted, nobody will bother. A password leak is going to have 100 million accounts in it, at least 50% of these reused without modification at other websites. Any automated bots and spammers will just try the exact passwords on other sites. If it doesn't work, they move on to the next account and password, instead of trying to guess modifications of non-working passwords.

What do you do for forced password change requirements?

Does your threat model include anything NOT bulk, ie where a human would see a password and guess the pattern?

Have you tried any of the password managers that have integrations, to automate password changes in case of failure?

Have you ever heard of the security concept of minimizing your attack surface?

My algorithm gives me flexibility to increment the password. I've had to do this before and almost all the time, I use it enough that I simply remember, "oh this banking site is incremented twice".

I have no opinion on password managers. It's just something I don't want to commit time to. My solution is easy and requires no management on my part. Ie. no software or hardware or anything to maintain.

I'm a fan of mixing this idea with something like 1Password. Obviously depending on the application, the security increases or decreases. My approach is to memorize multiple base passwords though & then mix it with some random gibberish. So I might write my password down like this:

KXl2h!H (H)

That would tell me that the password is KX12h! plus whatever the base password for H is. My hope is that unless someone was really targeting me, I would be skipped over as not worth the effort.

This way, even if someone broke into 1Password or one of my other password managers, they still wouldn't have the password.

The part I struggle with most, is how/where to store these & Authy/Google Authenticator tokens in a manner that they can be delivered to specific people in the case of my death without decreasing security.

>The part I struggle with most, is how/where to store these & Authy/Google Authenticator tokens in a manner that they can be delivered to specific people in the case of my death without decreasing security.

Something I've often wondered about...

I recommend reading about Shamir Secret Sharing. You could have a system setup such that (for example) you give 16 friends each a code and 9 of your 16 trusted friends all have to work together in order to get the original secret.

I use the same algorithm and am very happy with it.

This is very very similar to what I do and it works out great!

Reply on news.ycombinator.com