Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I personally have (and preach) a password system using a "root" password shared amongst many passwords, plus a unique password component.

So for Gmail my password might be correcthorsebatterystaple + F00@$DF and for another application it would be correcthorsebatterystaple + 3p1cp@$$w0rd. The idea is you get a large amount of entropy out of the root password while easily remembering it (because it's always the same), but since it's not all of the password, if someone has one of your passwords, they still don't have them all. The unique part of the password is easier to remember because it can be shorter while still a very large character count and large amounts of special characters.

Is there a term for this sort of root + unique password scheme? I'm trying to look for good articles about it or any potential pitfalls of it but I have no idea how to refer to it. It's also very hard to explain at first.

share|improve this question
I'm not sure how good it is to do this though. Once someone finds two passwords, he can be almost certain what the base password is, which makes further cracking that much easier. But yeah, what are the odds... Just don't do it when working for the CIA I guess :) – Luc Sep 14 '12 at 17:54
@Luc practically speaking you'd still need hashes of all other passwords to even attempt any sort of attack, and you have no indication of what the unique password end is. Plus it's still free entropy if your extended password meets whatever criteria anyway. – Ben Brocka Sep 14 '12 at 18:26
2  
The problem with this type of scheme is that it is an extension of the 2nd most common behaviour from users (the first being to reuse the same password everywhere) - so it is looked for. If you are a target (as opposed to a drive-by) then with a little bit of effort the prefix may be discovered on lower security sites, at which point you are back to the entropy of your suffix as sole protection. So while I agree it is a stronger idea than using the same password, you still want to use a suffix longer than 8 chars! – Rory Alsop♦ Sep 14 '12 at 18:38
@RoryAlsop I use long-ish suffixes but not as long as the prefix. I've actually got tiered prefixes in part because the passwords have proven too long for certain site's password requirements (that ticks me off so much) – Ben Brocka Sep 14 '12 at 18:52
You're assuming that the password is never stored or captured in cleartext. In practice, this assumption is wrong. As soon as the password is in cleartext somewhere, your prefix is compromised. Correlating your accounts between sites to try similar passwords is not that uncommon (get a list of $social_site_1 passwords, try them (and variations) on $social_site_2 with the same username, or with the helpful link you or the site itself put in your profile). – Gilles Sep 17 '12 at 8:35
show 1 more comment

2 Answers

up vote 1 down vote

A better solution would be to use PBKDF2 to turn your master password and random value into a site-specific password. That way if the site is ever hacked the crackers will have to first spend a lot of effort brute-forcing your site-specific password from the site's password hash then spend even more effort brute-forcing your master password from the result.

share|improve this answer
Checking your mail somewhere on a system that is not yours will become very hard. You probably don't remember that hash of over 30 characters long... And having to use some site to obtain the other site's password doesn't sound recommendable either. – Luc Sep 14 '12 at 22:29
PBDKF2 allows for a both a password and a salt. The idea is you remember the master password and have a list of sites with salts (which do not have to be secured). Then you use the master password and the site-specific salt as inputs to PBDKF2 to generate the password for the site. – ericball Sep 17 '12 at 13:19
Yes, so to generate a password to login anywhere you need some PBDKF2 tool. – Luc Sep 17 '12 at 14:30
up vote 1 down vote

I don't really know if there is a term for that. But I propose Smurf passwords.

As an adaption of the term Smurf Naming Convention. Seen on New Programming Jargon, jargon No. 21, by Jeff Atwood.

Note that this term has (IMO) no negative connotation, and it is kind of funny, so it would be easier to remember it

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.