How I salt my own passwords and sleep a little better at night

This is just a way to create a slightly more complex password, if it's stored as a fast hash (like md5) then it's still going to be very easy to crack.

The problem with this method is that if one of your passwords is leaked and cracked then it wouldn't be too hard to guess how your scheme works. This gets even easier if they have 2 or more of your passwords.

It seems to me that a scheme like this would have to be much more complex, which unfortunately would just make it a pain to use.

I really wish Google, Mozilla, Microsoft, etc would step up and build a better authentication system right in to the browsers, perhaps with public key cryptography like SSH uses - then we'd have automatic logins to any site you decide to trust, and no more passwords.

This is not good protection against a targeted effort -- when somebody wants to get your account as opposed to any account, when they have one instance of a "salted" password they might be able to reverse-engineer your salting effort and apply it to another site. And they don't have to completely reverse it, either, it might be enough to significantly reduce the difficulty of brute force.

But it sure beats using an identical password everywhere, and it does have the one major (and massive) advantage of using an identical password on n sites: you only have to remember O(1) things as opposed to O(n). And it can still be done completely in your head, as opposed to other schemes ("real" hashing schemes, password managers) which may introduce their own invulnerabilities or will lock you out from accounts on other computers.

Why not use a password manager? You only need one password and don't have to do salt tricks. There are even password managers with 2-factor login. Unique strong passwords for each site auto filled. Super easy.

This is, in my opinion, the best way (by far) to handle passwords for non-security-critical accounts.

Came across this forum that you last visited 7 years ago? Remember the password? With this technique you will, without resorting to password managers - and still have a unique password on every site.

Remember not to make your salt obvious though. In other words don't just append the domain name in front of the password or it will be quite worthless. Instead take for instance the third letter in your password and let it be the second-to-last letter in the domain name (and do some further transformations), and you're good to go. You will remember the specific password for sites you go to often but for any site you will be able to "re-generate" the password in your head.

By all means, strengthen your passwords. But a major flaw in this approach and many others is that there is no validation step at the end. These days, users must ask themselves questions like, "Is the hash of this password likely to be in a rainbow table?" or "If an attacker knows two of my passwords, can they determine the rest?" Any sufficiently random and/or complex approach is still capable of generating weak passwords. Unfortunately, the only question users tend to ask themselves is, "Can another human guess my password?" That's not enough and hasn't been for a long, long time.

I have been experimenting with using what I call a "site specific password munger." Basically it takes a key (random data stored on the computer), a password, and a site identifier (say: "hnews") and produces a password. I have been using it for several sites I use frequently and so far I have found it to work quite well. When I am remote, I use my phone to ssh into a secure server to compute the passwords and then copy them off the screen.

https://github.com/timtadh/passmash

I don't do anything of the sort and not only do I sleep fine at night, I don't have to go through some ridiculous ritual 100 times per day just to log in to a web site.

if your password handling affects your sleep, you need a more rigorous solution than a little piece of software.

Use five random words from diceware.com to create a password, and you will have 65 bits of strength. No more tossing and turning.

Dude, just use bcrypt, no need to reinvent the wheel

First of all, choosing nursery rhymes or movie titles isn't much better than choosing dictionary words. That strategy has been shown to have low entropy. Multiword passwords are easier to remember, but you need something actually random. If you want a strong multiword password, it's a good idea to have an actual RNG do it for you, so you can use something like http://passphra.se/. If they don't already, hackers will soon have dictionaries that will crack passwords like "ring around the rosy" and "there is no spoon" as easily as "champagne", but they're never going to crack a password like "eager man dirt fly" in better than brute force time.

OK, so with that out of the way, let's say you've chosen a weak (and common) password. If people start using this self-salting scheme, it's a fair bet someone else that will use the same self-salt as you, and that means two identical hashes in the database. That's bad news.

But it's also easy to fix. Simply choose some fixed salt to also add to your password. It could be the first two letters of your username, for example. That way, if "bobmarley" and "jackblack" both have the password "champagne" and both used the first four letters of the website for their salt, then on linked in one will be "linkbochampagne" and the other will be "linkjachampagne", and they can rest knowing that it's very unlikely that their password will hash the same as someone else's.