Hacker News Reader

Some good thoughts here.

Perhaps it would be better to have a more obscure suffix for Tier 1 passwords. Otherwise, if a password is compromised, a motivated attacker wouldn't have much trouble guessing your other Tier 1 passwords.

"wheatgrass makes octagrams in paypal" leads trivially to "wheatgrass makes octagrams in gmail" and "wheatgrass makes octagrams in #{bank_of_choice}".

View on HN

Good point. What would you use as a suffix then?

1. Switch your keyboard to dvorak (can be done with a key combination in all OSes)

2. Write "paypal" as you would in a querty keyboard

The result is both easy to remember and very hard to guess ;)

You could transpose the word in some way. So maybe move each letter two keys to the right - 'p' becomes ']', 'a' is 'd' and so on. They you end up with ']di]dl' instead of 'paypal', which is a bit more obscure. It might not work so well if the rest of your passphrase is made up of dictionary words.

I'm a bit paranoid though - most compromises aren't targeted and if a hacker gets a list of 20,000 hashes to crack they aren't going to inspect them individually.

Reply on news.ycombinator.com