Yes, a password algorithm is better than using the same password over and over, but a password manager is better still, and while initially less convenient it's eventually more convenient (since with a password algorithm one must rotate all passwords on the terms of the shortest-lived key, and one must use the intersection of all password rules — which may not even be possible). For that reason, I think that a secure…
> not something like LastPass Why? Friends have found LastPass to be pretty reliable and user friendly so far.
Password Algorithms
61–70 of 114 posts
Re: Password Algorithms
#62This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your user…
> Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords.
If. Depends a lot on how easy that attacker can identify those accounts as belonging to one set. Easy when they all go to the same email, but deep in the realm of individually targeted attacks if there is a layer of redirection. It's a tradeoff, password managers come at the cost of making their users part of a very high value dragnet target. I guess the proper way to do it would be to augment managed passwords with a brain-based component. That, and stuffing the password manager with a few canary accounts on high-value sites that send out login notifications.
Re: Password Algorithms
#63Earlier quoted context omitted.
How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.
Logging into a system that doesn't support your password manager, such as games consoles, shared computers, restricted work machines etc. Copying over a really long generated password is much harder than an algo you can perform in your head.
Even worse - entering a password into a device without keyboard. Smart TVs, streaming sticks, consoles, etc. Extra fun when every input character is immediately masked.
Re: Password Algorithms
#64If you're going to use an algorithm (which seems like a bad idea), wouldn't it be safer to keep a large secret key and then hmac or hash(key + service name) as your password?
At that point just use a manager. The point of an algorithm is that you can generate it using only your brain. Your brain can't easily calculate hashing digests.
Re: Password Algorithms
#65Earlier quoted context omitted.
This threat only holds for dedicated attackers. 1. They have to have multiple passwords to have a chance to derive the algorithm. 2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.
3. With Yahoo leaking billions of accounts, and hundreds of other services leaking 10's of millions of accounts, your passwords are already out there. 4. Someone makes a John the Ripper/Hashcat plugin that searches password dumps for common usernames/email addresses and attempts to determine if the password is based on an algorithm. 5. With advances in NLP AI, this will just get easier in the future.
> and attempts to determine if the password is based on an algorithm.
How is it going to do that? Especially since every website has different length and character requirements?
Re: Password Algorithms
#66I'm not sure why Password Algorithms are rising in popularity. We refute them every time they come up. They don't work. They work UNTIL one of your passwords gets compromised. Then you're stuck either rotating one of your passwords and remembering which one(s) have been rotated, or you're stuck rotating every one of them. I wrote this page to be a guide to friends and family, but I feel like I end up linking to the r…
> We refute them every time they come up. They don't work. They "don't work" in theory, but in practice hardly anyone is individually targeted by attackers. 99.9% of compromised accounts are due to automated attacks churning through compromised databases looking for low hanging fruit. People who use algorithms are not low hanging fruit.
Regardless, I'd say there's a good chance your password will be compromised at some point, through no fault of your own. Hell, if you had a Yahoo account, you should have probably rotated it, what? Three times in the past year?
It's the forced rotation of passwords due to breaches that throw a wrench into the algorithm scheme. Even assuming no one ever actually figures out your leaked password because it was properly hashed and salted, if you as a good citizen are rotating your passwords with every breach, your Yahoo password should now be in its fourth iteration, while your other accounts may only be on your first or second. Trying to keep track of that, in practice, is unmaintainable.
Re: Password Algorithms
#67Earlier quoted context omitted.
My guess is that the intent is that the passwords would be recoverable by you without the aid of a password manager, but that the relative convenience of a password manager still adds benefits (e.g. behaviourally: guiding you away from any potential tendency to opt for "simpler" passwords out of laziness)
> that the passwords would be recoverable by you Just click "Forgot password"?
I suppose I could reword "recoverable" to "usable in relatively rare situations where your normal password-manager-enabled workflow isn't conveniently available" - depending on how rare these situations are, resetting every single time could be quite an annoyance.
Re: Password Algorithms
#68Earlier quoted context omitted.
> We refute them every time they come up. They don't work. They "don't work" in theory, but in practice hardly anyone is individually targeted by attackers. 99.9% of compromised accounts are due to automated attacks churning through compromised databases looking for low hanging fruit. People who use algorithms are not low hanging fruit.
Regardless, I'd say there's a good chance your password will be compromised at some point, through no fault of your own. Hell, if you had a Yahoo account, you should have probably rotated it, what? Three times in the past year? It's the forced rotation of passwords due to breaches that throw a wrench into the algorithm scheme. Even assuming no one ever actually figures out your leaked password because it was properly…
Even worse than password rotations are site-specific password requirements. Every site has different requirements that require my algorithm to take different branches. To remedy this, I have a google doc that has a list of sites I use along with what their password rules are and how many times they've been compromised. The difference between this and a manager is that I don't care if that google doc file is compromised or not. It's all public information that is useless to an attacker. That public file is merely an input to the real manager in my brain and for common sites that I use a lot (google, amazon) I don't even need it.
Re: Password Algorithms
#69> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…
I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.
> I have BANKS and INSURANCE companies require CASE SENSITIVE, alphanumeric only passwords. It's pure insanity.
Of course passwords would be case sensitive, why wouldn't they be?
Re: Password Algorithms
#70This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your user…
> Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. If. Depends a lot on how easy that attacker can identify those accounts as belonging to one set. Easy when they all go to the same email, but deep in the realm of individually targeted attacks if there is a layer of redirection. It's a tradeoff, password managers come at the cost o…
It would be pretty easy to identify accounts for same users. Most people use same email or username on most of their websites.
The point of password managers are to have true different password for different site and users don't need to remember it. For the inconvenience the author has, there are other secure ways to handle that, no need to sacrifice security for convenience. For example, to have a usb drive with portable password manager installed.