Poor man's 2FA. Should I use composite passwords and how much does entropy matter?

Question

I use a password manager, I vary the length of my passwords occasionally and they're all unique and random but I think - what if the PW database leaks (e.g., malicious software exfiltrates the contents)? Not all sites support 2FA so how can I increase security?

I came up with an idea. I decided to type a word at the start before I autotype the long random password. The word is always the same for every account in this "important" category and the word only exists in my head. The idea is if the database leaks then no one can get in to my most important accounts because they don't know the word.

This is a sort of 2FA without the need for website support. If multiple important credentials were to leak it would be obvious what I was doing and you could assume there were other passwords that I use with this word at the beginning. I assume this decreases entropy. In what scenarios would my system be less secure, if any? Could knowledge of my secret word from one leaked credential (e.g. from a website breach) help you crack another of my accounts beyond the obvious benefit of knowing e.g., 5 of my 25 chars? Am I better off not doing this for some cryptographic reason or is it a sensible extra precaution against a database leak?

After seeing some answers, more concisely, could knowledge of [staticWord]'s existence / content / position, help you crack "[longRandomString][staticWord]" or is it always at least as strong as [longRandomString]?

Just thinking through this, is there a possibility an attacker may not know they've cracked a password if it's a random string, until it's tested to see if it works. Whereas you could assume it's cracked if you decrypted a random looking string and noticed a real word at the end of it. I don't know whether this could/would happen. I think my staticWord should be short and random.

Answer 1

What this doesn't protect against

You don't really specify which database may leak. If the database of the web application leaks, or if your complete password leaks - eg via phishing - your scheme will obviously not help against that at all, because it's not real 2FA.

What this does protect against

On the other hand, if your password manager database - and the corresponding password - leaks, this will help in certain situations.

If we assume that an attacker knows that you are using this scheme, you are now essentially using the same password on all websites. Your security now depends on the security of the weakest website you registered, and on the strength of your additional password.

Things to take into account

Your second password should be reasonably strong, otherwise the scheme is useless.

Obviously it should also not be the same password you use for your password manager.

I would also recommend that you append this password after the password stored in your password manager. Some websites may cut off your password after X characters, and if X is small, you may end up with just this extra password, which will make leakage more probable and reduce your overall security. On the other hand, if your additional password is cut off, your back where you started (no additional security, but also no additional weakness).

Conclusion

Your scheme may add a small amount of additional security in case your password manager data leaks, although the added usability disadvantage - having to type the additional password - wouldn't be worth the trouble for me. At the most, I would use the scheme for extremely important accounts.

A more reasonable approach would be to have two different password manager databases: one for the less important passwords which you can also use on systems which may be more likely to be compromised, and one for important passwords, which you will only use on systems you deem to be secure. This should achieve the same goal you want to achieve in a cleaner way.

Answer 2

You are using a password manager and want to protect against the leakage of the password managers database.

You may take a look at the mooltipass password manager. https://www.themooltipass.com/ This is a physical device, which stores your passwords. This will protect you against the leakage of the "complete password database".

Of course you are still using passwords. I.e. it does not protect against:

1. Sniffing/keylogging/shoulder surfing of the password when it is entered. This will compromize one of your passwords.

2. Leakage of the services' user database. Which will compromie the hash of one of your passwords.

So there are some scenarios it protects you against like:

• stealing your local password database by some trojan.

Answer 3

just utilise the forgotten password feature in a website randomise the password and if you lose your DB then forgotten password comes into play.

but why not use a cloud solution for your password manager like dashlane. all backed up to the cloud; implement two factor in the cloud as well.