I recently came up with the problem, that I have much more accounts, than I'm able to remember passwords. I don't want to use a password-safe, because I cannot access it on another computer, I lose all logins if I lose this safe and an attacker gets a much logindata, if he compromises the safe. Instead I wished for a method, to generate safe passwords with a method you can always reproduce and only remember one password/phrase/secret. To find such a method, I asked this question.
In the meantime, a friend and I came up with such a generation-method. Now I want to know, if it is insecure, which weaknesses it contains and how it can be possibly improved.
The method we came up with needs one central secret. This should be a text, that no one else knows, but is easy to remember for yourself. A poem might be easier to remember, but you should create something personal, so that no one can conclude to the text. So don't take the Jabberwocky, as everyone knows this text. (But I will choose Jabberwocky for the example).
Now you take the name of the platform you need an login. That can be something like HOMEPC or STACKEXCHANGE. Take the first character of your account and search for the first word containing it in your secret. For Jabberwocky the first word with a 'h' (HOMEPC) is 'the' and the first word with an 's' (STACKEXCHANGE) is 'Twas'. Now take the next word with the following character, and so on. This way you generate the specific password. The examples are:
HOMEPC -> 'the toves gimble the vorpal Jabberwock' STACKEXCHANGE -> 'Twas the and Jabberwock took time manxome Jabberwock with flame And through The'
If the secret is not long enough, start over at the beginning. If the platform-name is too short take it double or three times. Same if you have the feeling, the password is not good enough.
EBAYEBAY -> 'the gimble wabe mimsy were borogoves And my'
The secret should contain every character at least once (Jabberwocky missses q and z).
What are the weaknesses in this method? How you can attack passwords generated by this, or even worse - conclude to other passwords if intercepted some?