Password reuse is bad for many many reasons. More secure systems require changing a password regularly preventing reuse.
One potential solution to this is a password generation scheme. Imagine a base password and a simple algorithm for modifying it based off of a very simple or short password that is made up each time. The simplest version being appending the short password to the base password.
Looking at the simplest version, I have some base password
foo and for each website I come up with some easily remembered, not overly secure, word to modify it. So my password for gitlab becomes
fooGit and my password for facebook is
fooFace etc. For places that require changing passwords every month, it could be as simple as
fooThree etc, some easy to remember modification each month.
foo is actually a relatively strong password, how secure would such an approach like this be?
If the algorithm I mentioned was as trivial as what I mentioned it would be easy for someone who gets your old password to guess at a new password. However, someone would have to have access to at least two alternative passwords to figure out your using an algorithm like this, and even then they would need to guess the value appended to it. They would lack rainbow tables for your password algorithm, so unless they can just guess what your next password is they have limited means of attacking your password I would guess?
My belief is that this approach would lead to a relatively secured approach, despite the potential for guessing at passwords once someone figures out the algorithm. My reasoning is basically that no one is looking for this algorithm and so it's likely to go unnoticed. Is that true, or are attackers aware of people trying something like this and actively attempting to exploit it?
If the algorithm was mildly more complex than 'just append the two values", but still simple enough to be done quickly in one's head, would that do anything to increase its security?