Hacker News Reader

Comment by stormfather | Hacker News Reader

I have a rule that modifies a base password depending on the name of the site the password is for. That way I only have to remember the base password and the rule.

View on HN

I have three of your passwords and the domain each is associated with. The pattern is obvious, so now I have all your other passwords too.

Also, you don’t need to remember only the base password and the rule. You also need to have an exceptions process for when your “generated” password is incompatible with the esoteric requirements of a new site (length, character restrictions, etc.). And you need to remember this at login time, when you aren’t presented with the same information about those requirements as you were when you registered.

When I used to do this (and I feel safe talking about it because I haven't done this in many years), I also kept a document that listed any such exceptions. Generally the document would just say something like "mixed case, number, symbol" which was enough to remind me what I did.

I used to do this (10+ years ago), but once a few get leaked, everything else would get exposed if someone wanted to target you.

Much easier to just manage randomized passwords through 1Password.

There is an improved version of this, basically a password generator based on a phrase + service name - https://getvau.lt The issue is that once a password is compromised you need to change how you generate it and remember this exception in the future.

I used to do this but stopped a very long time ago. I use KeePassXC instead. It’s much more secure and much better at handling websites with special password requirements.

Reply on news.ycombinator.com