Is this cross-site password model secure?

Question

I'm looking for a way of securely having passwords for different pages. Say I generate this password:

ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5#

Then, for each site, I change a single character. It's a single, random position with a random character shift. Isn't it almost as secure as having a string half the length randomly generated, unpublished and not reused? Then I'd only have to remember the 1-64 character position + another number in my memory, instead of the whole password.

What pitfalls does this model have? I don't know how to measure the strength of this. I haven't used this model [yet], but I think it might be very useful for many people and situations, one being the case of a travel. The main problem I can see is a binary search can yield to, in average, 1/2 the strength of the whole thing (still kicking-ass strong).

To answer, please, consider that the position and shift are truly random. How much more secure is it if the original password is not published anywhere? Since I'm not specifically looking for security through obscurity, I'd like to know.

Note: I know about correct horse battery staple and using a password manager, I'd just like to know if this is actually strong since I don't have the expertise to judge myself.

Answer 1

It was vaguely strong until you published your mechanism. Now, if someone manages to get hold of your base password and a hash, they only need to try about 6500 passwords to crack it - i.e. ~100 printable characters per position, with ~65 positions.

Not only that, but it's clear that you "keyboard hammered" in order to generate the base password, which means there will be statistical correlations that make discovering the base easier.

If you're storing the base password in a secure manner, there's no reason why you can't just store a full set of unique passwords in a secure manner. Invest in a password manager such as KeePass and your life will be a lot easier. Heck, it's way easier to remember a single strong password than it is to remember a whole score of offsets and alterations!

Answer 2

An Optimistic Assessment

Your variation makes the password longer and composed of more characters which will help protect you from automated attacks.

Real-world complications

Many sites don't allow 64 characters for a password, or truncate after a certain number of characters. This article is 9 years old, but it shows the following maximum password lengths:

8: Schwab
15: Capital One
16: Microsoft
24: AT&T

https://arstechnica.com/information-technology/2013/04/why-your-password-cant-have-symbols-or-be-longer-than-16-characters/

You will need more than one letter to tell Flickr from Facebook, FedEx, Fidelity...

An actual human will look at that and be suspicious of the G for Google. I bet they'd try "F for facebook" in their first 3 guesses, or similar for Goo -> Fac or Ge -> Fk

If you put the 3-character unique site identifier at a different point in each password, there are a maximum of 62 places for it to go. Presumably you have a method for determining the placement, like A goes at 1, B at 2, lowercase starts at 27, and so on. Or you use some substitution cypher equivalent for such a system. We're down to a 1:62 chance of a human attacker guessing your pattern. I bet if they have 3 passwords, they can make a much better guess than that.

Who wants to remember 63 characters, plus a substitution cypher, and type that into every site, every time, for such poor security?

How is that better than using all strong, random passwords, generated, stored, auto-filled, and backed up by a password manager, effortlessly? I think there is no comparison for security or ease of use.