4

Remembering a lot of passwords is difficult. A lot of people use the same or a small set of passwords for everything.

Of course, this is very unsafe. If such a password a password is stolen, the adversary could get into several or maybe all of your accounts.

Let's say I have the base password Fo0b@rPW which I'd like to reuse in every account I use.

Fo0b@rPWgoogle ; Fo0b@rPWfacebook ; and so on

This is at least a little safer than reusing the same password but still pretty vulnerable to dictionary attacks.

How can I alter a single password in a way that it is safe but I still can remember which is the variant for each site?

One idea I have is to add specific digits at specific offsets like:

Fo0b@rPWgo2og4le6 ; Fo0b@rPWfa2ce4bo6ok8 ; and so on.

EDIT:
The problem is, that someone who could get one password in plain text, is able to figure the other passwords out. This means that the site-specific part has to become part of the entropy as well.

Now if I use some sort of elaborate algorithm like

Take the first digit of host name. Take the crossfoot of that digit's dec ASCII value . From the offset(crossfoot), insert a string with the length(host name) Invert that substring, if offset is round number

Something like:

fo0b@rPWfac12345678ebook
fo0b@rPWgoog654321le

Improve this question
7
  • 1
    Don't try and remember passwords - use a password manager protected with a single, strong, memorable password.
    – SilverlightFox
    Commented Oct 2, 2015 at 8:13
  • 1
    Does not work on the fly on foreign devices.
    – jawo
    Commented Oct 2, 2015 at 8:29
  • There's no reason you can't make your strong stored passwords easy to type.
    – SilverlightFox
    Commented Oct 2, 2015 at 8:32
  • Still, how should I use a pw manager on a foreign device, without carrieing a portable pw manager with me all the time?
    – jawo
    Commented Oct 2, 2015 at 8:47
  • @Sempie bring your smartphone?
    – Natanael
    Commented Oct 3, 2015 at 18:31

1 Answer 1

Reset to default
7

In security we always assume the algorithm is known, as such adding some structure to a password will not help you to increase its entropy (strength). This as an informative side thought as this is not the subject of the question.

Assuming your "basic password" has enough entropy (is strong enough) your proposed method is actually rather safe on the assumption that all the sites you use this method on hash their passwords.

The safety of your method relies on not being able to use the password obtained from one breached site to gain access to other sites. When your password is hashed this is the case.

However should one site not hash your password, or have a vulnerability in their hash. The whole system is vulnerable.

What your system actually does is add "salt" to the system. Many sites already do this for you, best practice requires it. So what you are basically doing is adding your own salt which could help with sites that do hash their password but do not add salt. So opposed to using the same password everywhere this increases security but not a lot.

As such I would not recommend such method and would say that a password manager, even if they do have their issues, is a safer solution to the password problem.

Improve this answer
7
  • Which changes should I make to get them save, even if some sites might not use hashes? Maybe using different offets for different pages, however this should be easy to remember again,...
    – jawo
    Commented Oct 1, 2015 at 11:07
  • 1
    As I clarified in my answer the structure, whatever structure you come up with, will not make your password stronger. The advantage you gain from hashes is that knowing the hash does not grant you knowledge about parts of the password and as such you can reuse them. However if the password is not hashed (for a certain site) then you lose this advantage. When that site is compromised the part of your password containing the entropy (your basic password) is also compromised and as such every other password you derived from it as well.
    – Selenog
    Commented Oct 1, 2015 at 11:12
  • Is it possible to make the site-specific part part of the entropie as well? I'd have to alter the substring "facebook" or "google" or whatever in a way that one has no conclusion to the other, except that it contains the name of the host. For example: 1. Digit of facebook (f) as ascii val 102. Crossfoot -> 3. Now I insert another content at offset 3 with lenght(facebook) -> 8 like fo0b@rPWfac!"§$%&/(ebook. For google it would be offset 4 (g -> ASCII 102) with length 6 -> fo0b@rPWgoog!"§$%&le this is not THAT easy to remember, but easy to recalculate on the fly, if pattern is known.
    – jawo
    Commented Oct 1, 2015 at 11:37
  • Of course, a experienced cryptocrapher will get that if he has 2 or more passwords known. But with one single passwort it should be pretty difficult.
    – jawo
    Commented Oct 1, 2015 at 11:39
  • 1
    As I said in my post "In security we always assume the algorithm is known", requiring the opposite is "security through obfuscation" and is frowned upon in the security community. The reason for this is that while it might not get broken there is nothing we can say about it's safety. This is because it in essence requires creativity (or gaining access to the algorithm of course would do it) to break and that can not be categorized. For entropy we can say that would require X calculations to go through all permutations, creativity can not be qualified in this way.
    – Selenog
    Commented Oct 1, 2015 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .