Hacker News Reader

Comment by alexeichemenda | Hacker News Reader

I have a base password that I use on every website.

Then for every website, I (for example) use the first letter of the domain name and the last letter, add it to the beginning of my password. Then I take the last letter of the domain name and add it to the end of my password.

This way I only have to remember my tiny algorithm + my base password.

View on HN

This is almost as bad as just using the same password. Anybody who breaks one is gonna notice that the site's name is in the password and suddenly know all your passwords.

It's 2014. Password managers are great.

True, but there are some algorithms that allow you to combine a domain name with a single password and get a good unique password out. Unfortunately it's hard to compute bcrypt hashes in your head.

And if you're going to be using something to derive keys and store the results, you might as well just pump out a random string and stash it in the password management app of your choosing :)

This was an example. I am not actually concatenating 1st+2nd letter to my password. You can use the 1st letter of domain name in the middle of the base password, you can add the first and the last letter, resulting in a letter which will be added to the beginning etc. And in a 10-12 character password, it's very hard to 'notice' this.

I do something very similar to this, base password which is some digits and then some key word that comes to mind based on the website. For example I might use 123456cashmoney for my bank and 123456friends for facebook. Usually I use the first thing that comes to mind when I see the domain as I am very likely to think that same thing a year down the road when I am trying to remember that password! I've had a high success rate with this, rarely reset passwords for websites I dont access but once a year (ie turbotax)

Using words related to the target domain is one of the tactics most beloved by attackers, as that's where they'll be starting their dictionary attack. Hitting a bank? There are a few hundred bank-specific words, let's start with those, plus all the "cute" leetspeak substitutions and with prefixes/suffixes tacked on.

Reply on news.ycombinator.com