Hacker News Reader

Comment by tjogin | Hacker News Reader

What I do is I have an algorithm. Based on the name of the website/service and its purpose, I can calculate what my password should be on it in my head.

This means that every account I have uses a unique password composed of both alphabetical and numerical characters.

I store each of them in my head, or re-calculate it if I forget them, but I actually tend to just remember them, maybe because they follow an algorithm (or rather, a set of rules) it makes it easier to remember them.

And, I'm not contingent on any software to remember my passwords.

View on HN

Sounds like if I were targeting your accounts specifically, I'd have a pretty easy time of it. As soon as I get hold of one or two of your passwords I can work out the algorithm and then start calculating your passwords myself.

While it might be a better approach than just using the same insecure password on every site, based on the attack suggested in this article, there isn't much benefit from your approach.

Luckily nobody is targeting his account specifically. The original point, that your low-value passwords can be harvested, is I guess well-taken. But you're pushing it.

if the algorithm is something like:

password = sha1(masterpw1 + sitename + masterpw2)

I'm not sure you can deduce masterpw1/2 from a few passwords.

To each his own, but in my case I can calculate mine in my head without any assistance of any tool of any kind.

Yes, I'm sure he does that in his head.

heh ok I missed the 'in my head' bit. I just use a simple script to generate passwords.

I don't think you could work out the algorithm, because it's not mathematic. It's a handful of quirky arbitrary rules.

But hey, give it a shot; here are three random passwords (calculated using a slightly different algorithm than the one i actually use):

hotmail: 3m4m349 facebook: w45c033 aol: t41m325

Now, tell me what my Gmail password is.

I would never try and second guess somebody who describes himself as "Devil's Advocate Extraordinaire."

I thought you said you'd have a "pretty easy time" figuring it out?

If it was a simple algorithm, yes. I believe you have missed the humour, so let me make this clear: I have absolutely no interest in your passwords.

It is very very simple. Just arbitrary and not (entirely) mathematical.

is your hotmail password a typo? should it be m34m349?

Nope. But it could have been if for a different service/purpose.

Reply on news.ycombinator.com