Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Possible Duplicate:
What is your way to create good passwords that can actually be remembered?

I am using a self-developed "template" for my own passwords (like Facebook, Gmail etc.)

I use a small set of prefixes and suffixes and build a password like this: prefix + something meaningful, related to the site + suffix + pissible numbers

So, in case of Gmail my password could look like: foospambar112, foo and bar beeing the pre/suffix from my small set. This gives me longish passwords while keeping them easy to remember/figure out again and keeps me from re-using a password.

I'm really prone to forgetting passwords or mixing them, because there are so many of them and I hate recovering passwords, especially if site prevent you from using a password used in the past.

Am I right believing that this is an ok-ish approach to managing your passwords?

share|improve this question

migrated from crypto.stackexchange.com Dec 18 '12 at 15:46

This question came from our site for software developers, mathematicians and others interested in cryptography.

marked as duplicate by AviD Dec 19 '12 at 8:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Evgeni see this question security.stackexchange.com/questions/662/… –  Mark Davidson Dec 18 '12 at 15:56

1 Answer 1

Forget password schemes like this. All it takes is one breach on one website you use and someone could figure out your scheme, then break into all/most of your accounts.

Use a password manager instead, and store the password vault on a cloud hosting service like dropbox - that way you only have to remember a few strong passwords (one for your OS, one for your password vault, one for your dropbox, and optionally one for your email in case you need to recover your dropbox account). This gives you the ability to have strong unique passwords for all accounts, and only have to remember a small number.

I recommend keepass, since it's cross-platform / cross-device and free, but there are many others out there.

share|improve this answer
    
Well, I actually trying to avoid relying one password manager. –  Evgeni Dec 18 '12 at 16:02
    
"..All it takes is one breach on one website..."...to figure out a scheme, dont you need several "samples"? So it'd take several breaches on several websites...and I'm using several schemes.. –  Evgeni Dec 18 '12 at 16:05
1  
While I do like the password manager idea, the suffix/prefix approach can work very well IF all passwords are changed regularly. Leaving all those passwords out there unmodified for a long time leaves you exposed to having your scheme deciphered. –  schroeder Dec 18 '12 at 16:06
5  
Not only does a manager remove the burden of remembering "secure" passwords, it removes the need to remember where you have accounts. When databases are being compromised fairly regularly (another discussion in itself) it's good to know quickly and easily whether or not an old login was compromised. –  Jonathan Garber Dec 18 '12 at 17:15
1  
Additionally, good ones with browser plugins can entirely negate phishing attacks. If you're at a site pretending to be PayPal, and you press the hotkey to fill in your credentials, the plugin won't recognize the site and so won't fill them in. –  Stephen Touset Dec 18 '12 at 18:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.