Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a way of securely having passwords for different pages. Say I generate this password:

ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5#

Then, for each site, I change a single character. It's a single, random position with a random character shift. Isn't it almost as secure as having a string half the length randomly generated, unpublished and not reused? Then I'd only have to remember the 1-64 character position + another number in my memory, instead of the whole password.

What pitfalls does this model have? I don't know how to measure the strength of this. I haven't used this model [yet], but I think it might be very useful for many people and situations, one being the case of a travel. The main problem I can see is a binary search can yield to, in average, 1/2 the strength of the whole thing (still kicking-ass strong).

To answer, please, consider that the position and shift are truly random. How much more secure is it if the original password is not published anywhere? Since I'm not specifically looking for security through obscurity, I'd like to know.

Note: I know about correct horse battery staple and using a password manager, I'd just like to know if this is actually strong since I don't have the expertise to judge myself.

share|improve this question

1 Answer 1

up vote 12 down vote accepted

It was vaguely strong until you published your mechanism. Now, if someone manages to get hold of your base password and a hash, they only need to try about 6500 passwords to crack it - i.e. ~100 printable characters per position, with ~65 positions.

Not only that, but it's clear that you "keyboard hammered" in order to generate the base password, which means there will be statistical correlations that make discovering the base easier.

If you're storing the base password in a secure manner, there's no reason why you can't just store a full set of unique passwords in a secure manner. Invest in a password manager such as KeePass and your life will be a lot easier. Heck, it's way easier to remember a single strong password than it is to remember a whole score of offsets and alterations!

share|improve this answer
    
So simple and still I had no idea... But it's truth so I'm accepting it. I use Firefox Master Password currently, but just thought about this and wanted to check. Thank you so much! –  Francisco Presencia Jul 22 '13 at 0:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.