Hacker News new | past | comments | ask | show | jobs | submit login

you're thinking too much about the specific example and not the general point, but I edited the parent comment with an actual example

edit: oh, I did say append so I see why you'd think that. that's my bad. what I meant was include




By your example, your passwords are a set of fixed or knowable data, plus a unique identifier that in your examples is three characters long. Therefore knowing one of your passwords gives all except three characters of every other password, thus making your effective password length three characters (substitute the actual length of your unique identifier if it's more than three).


Possibly not even 3 characters; 3 numbers.


you're right - i have clarified what I actually do. however I do something similar with a different password for sites I deem unsafe, or spammy.


Sure, that's slightly better, but you're putting in quite a lot of effort for minimal reward - there still isn't much entropy here compared to the size of the password, and you're relying on security through obscurity (that no-one will work out your method). Password crackers on modern GPUs can chew through many millions of guesses per second so having such a significant leg up would likely make your strategy trivial to break.

Also plenty of perfectly respectable sites have been compromised in the past so your estimation about how safe the site is unfortunately doesn't help much.

I really think you'd be better off using long randomly-generated strings and keeping multiple backups of your password database. There are lots of options that don't put you in the hands of a third party. All (?) sites offer password reset facilities in case of emergency, and you could memorise your email account password so that you can always at least get into that.


the main goal for myself is to be able to have complicated passwords and remember them without a computer. the problem with all password managers is ultimately it must be possible to get them in plain text by design, so if someone gets that they get all of your passwords.


I’m confused how you worked 2022 into the password. Trying to deduce your algorithm.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: