Hacker News Reader

A good way could be to have a "base" password you then concatenate with the first 4 letters or so in the service

So for Facebook it can be "MYPASS" + "FACE"

And then it's easy to remember. Also you can substitute the first letter which allows it to a number or so

This helps when your password is lost along with thousands / millions of other passwords in a breach -- attackers would be trying to re-use passwords programmatically in bulk and wouldn't detect your algorithm.

But if you were individually targeted i.e. a human attacker is looking at your password, your algorithm would provide access to many of your accounts with little effort.

I used to use this solution, btw, but have now gone to a unique, complex password per site with a password manager.

I also used to use this solution about ten or fifteen years ago and have since moved on to password managers and long passphrases for accounts whose passwords I do not want to store in the password manager.

Reply on news.ycombinator.com