I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board http://www.codeproject.com/Lounge.aspx?msg=4911235#xx4911235xx).

I think, main point of this scheme is this: Do not use the same password more than one login.

For this purpose, Prof. Manuel Blum suggest a kind of hashing formula that people could run in their brain (not me).

If I take this advice and devise simplified version of my own hashing formula which will always generate 4 digits and 4 fixed string (ex: 2112$Pwd), will I'm more secure?

In other words, which is more important?

  • Unique password for every login
  • Never use trivial password (ex: user name plus one digit)
  • A drawback to be noticed in the Mental hash process, is what happens if a service requires you to change the password every 6 months or a fixed time period? Do you change the scheme itself? What can we do about this scenario? – gboverflow Nov 29 '15 at 0:35

The two defences you list are meant to protect against two different attacks.

Unique password for every login

This is meant to protect against a leak of someone else's password database. Even if the attacker works out your password, it's useless as it only allows access to the single website the leak happened on (which you've probably changed by the time the attacker gets the password).

Never use trivial password (ex: user name plus one digit)

This protects against any password database leak. If a password database leaks (and the password is properly hashed) then this makes it harder (and maybe impossible, depending on the entropy of your password) for the attacker to actually reverse the hash and get your password.

This might lead you to believe that a strong password is the most important defence of these two. However, you cannot guarantee that a website hashes the password correctly. For example, in the massive Adobe breach recently, the passwords were not salted. This meant that attackers could reverse a great many hashes very fast.

So you see, your password could leak in plain text, or in a reversible form of encryption; making it easy for the attacker to know your password even if it's strong. In this case, your only defence is making sure you have a unique password for each site.

In the end, it's your choice, but neither defence is to be considered secure on its own. My recommendation is to use a password manager, to gain strong and unique passwords for each site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.