I've heard that its a bad idea to create passwords based on a common form such as random letters appended with the start of a websites domain name. So for example a password to gmail might be something like 8*dfJK3!%kgmail and a password to facebook would be 8*dfJK3!%kfacebook and so on. Why this considered a bad idea?
1
-
2Because if only one site didn't do anything to secure your password, and it's exposed, your system is really easy to figure out and can be used to potentially login to many more sites.– user72066Commented Nov 23, 2015 at 8:02
Add a comment
|
2 Answers
Reusing passwords across multiple sites is very problematic as a password exposure on one site leads to a password exposure on all of your accounts that used the same password. What you are proposing seems better than using a static password across multiple sites, but it is still rather predictable. If someone discovers one of your passwords they can likely guess many of your other passwords. No matter how careful you are with your passwords, they will be discovered. Sites get hacked and password lists are published.
The only way to ensure password safety is to use unique random passwords that have a provably large entropy (a measure of randomness). This answer discusses randomness as related to password generation.
answered Nov 23, 2015 at 5:39
-
To take that one step further: Passwords don't need to be random, but they do need to appear random to an observer. Anything that is obviously generated limits the entropy of a password. In the question, there's a universal password and then a site name. An attacker with your gmail password will likely guess your facebook password in a single try. Consider something like SuperGenPass if you want to use a universal password securely. Commented Nov 24, 2015 at 20:32
-
I think that tools like SuoerGenPass are not widely accepted @AdamKatz. For example, what do you do if you need to update a password for a site? There's no way to get a second one out of SuoerGenPass. Commented Nov 24, 2015 at 20:47
-
-
But what about all the sites that you didn't update your password? You'll need to keep track of which sites uses which password? Unpleasant. Commented Nov 25, 2015 at 3:31
Because it's easily predictable. There was a study done on organizations that enforced a password policy which required every password to contain at least 1 symbol and 1 digit. The results of the study concluded that passwords of the form
<phrase><symbol><digit>
e.g. Example@1
were very prevalent. A malicious attacker can use this to his/her advantage when cracking passwords, drastically increasing the success rate of finding a match.
-
But
<phrase><symbol><digit>isn't really what the OP is proposing. Commented Nov 23, 2015 at 5:28