Hacker News Reader

Comment by throw__away7391 | Hacker News Reader

I have a system known only to me for assigning passwords based on things like the color of the company's logo and the number of vowels in their name. I have a complex and unique password for every site, I don't have to "remember" them because I can recreate them on the fly. This works really well imo, the main hiccup is companies that force you to change your password every x days and don't let you reuse old passwords.

View on HN

This technique sounds great but has some challenges.

Firstly, companies change logos, change names, force password resets or your password will leak in a breach. How does this system accommodate those scenarios?

Also, once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula.

It is not out of the question that there already is or will be technology to compare multiple passwords from the same person from different leaks and derive the formula.

> once a few of your passwords are in data breaches, anyone who wants to target you can derive your admittedly less complex formula.

It's true that's a hypothetical attack vector.

In practice, so few people use this approach that you're not going to see a general-purpose deployable attack suite based on this principle. It'd be useful for a targeted attack, but if you're under a persistent, targeted threat there are better tools (spear-phishing, social engineering, physical compromise, etc.).

Until the company changes their logo...

Or one is cracked and the others are easy to figure out. Because these types of algorithms tend to feel complicated, but are not as you still have to remember it.

Reply on news.ycombinator.com