I have a lot of accounts and until some time ago I used an universal password for all of them. Right now I have a different password for every account depending on the website name that I am logging in. I use a pattern and the difference between patterns is the website domain name.
I dont want to store my password in some kind of password manager. I just want to have a pattern in mind and compose the password depending of it (and a piece of paper hidden somewhere safe in the house in case I am really dumb and I forget the pattern).
Could you suggest me some good patterns? So I can get one or a mix of them to make a better pattern for my passwords.
Is there any better way to store passwords but still access them if you need to log from another computer/device?(I dont really trust password managers)
If you don't want to forget them, and don't trust a password manager write them down! (Schneier.com). I would consider some form of obfuscation here so that a casual thief stealing your wallet can't just log in to your paypal account (for example), even though this is hard to do well.
1) If you don't trust online password managers, you can use offline managers like keepass2, but you'll have to get your file accessible anywere and the breach would be there. If you really don't want to trust password managers... learn your passwords.
2) There are several types of pattern which can be used to generate passwords. They are not always safe, so generated one are better. An article has been publicated on this subject on NakedSecurity here, they present different possible patterns.
You can use a hash-based password generation strategy. You combine a master password with the site name (and its complexity requirements) to generate a password unique to the site.
It has some advantages and disadvantages compared to a password manager:
There is no encrypted database that you can lose / get stolen and attacked
You need to remember the settings used to make the approach work for sites with different complexity requirements
A poor implementation, like taking 8 characters from a md5 hash can reduce the keyspace significantly.
Cases where you are forced to change your password are hard to handle
There are a few tools that can be used:
normal hashing functions (You should avoid this) e.g. The example presented here (That post also have the strengths and weaknesses of the approach)
Tools to automate the process, like supergenpass (MD5 based by default which is not ideal, a slower hash makes recovering you master password trickier if a generated password + the sitename is known to an attacker) (Although you should probably have a master password that is long and random enough that it is hard to brute-force) (Other exist, such as Master Password, see below)
(Via Matty: Master Password seems to use a much better way to generate passwords than any of the others mention previously)
With a password card, you pick a starting point and a path for where to go from there (up, down, left, right, diagonals, or some combination) and remember that. (Or, multiple starting points and paths per password.) You don't have to trust software password managers because the paper card is your password manager, and the hash at the bottom is the "master password." You still have to keep track of some information (starting point and path) separate from the manager, so even if you lose your wallet the passwords aren't gone with it.
I think "Off The Grid" (https://www.grc.com/offthegrid.htm) might meet your requirements. It's based on a randomly generated grid and a method based on the domain name to generate the password from that. The pages on that site describe the "standard" way of using the grid, but there are also suggestions about how you could tweak it, so even if someone got hold of your grid and knew the "standard" method, they still wouldn't be able to work out your passwords.
I like to use popular quotes from movies. I take the first letter of each word and turn each into a different capital letter, lower case letter, symbol or number and try to use 4 of each and keep them different.
'What' ain't no country I ever heard of, do they speak English in
becomes "W@4c!3%7D^S9Iw?". I like to tag on a small series of symbols and letters I can remember if its too short. like 456 with shift held every other one. "W@4c!3%7D^S9Iw?$5^"
What I would do is use a complex base string for the password like AdasfbkSDUn7657AJDadadsag and then for the website , which I am creating the password for, I would append it's name to the begining. If remembering the password seems daunting (which should be , use an offline password manager).