This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your username or email.
Password Algorithms
21–30 of 114 posts
Re: Password Algorithms
#22I don't think this is good advice. Password algorithms are security by obscurity, and only work as long as people don't figure out your "trick" to generating passwords that look random.
You should be able to publish your password algorithm without people being able to compromise your accounts. Here's mine:
Pick 20-30 characters from the set of alphanumerics and special characters. Adjust length and character set to match site requirements.
With the given example, if your password is leaked plaintext on two sites, someone can reduce their brute force space from 100^30 to [A-Z][a-z][A-Z]B1a3k#[0-9]{1,2}.3 or 26^3*10^2 which is roughly 100^3
Re: Password Algorithms
#23Earlier quoted context omitted.
* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif
Heh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.
I hope you chose pa$sw0rd.
The NHS online booking system my GP uses has rules like this. Pretty much guaranteed to prevent old people from being able to login.
Re: Password Algorithms
#24This is the false sense of security through obscurity. Given the simple algorithm and without any entropy, it will be trivial to crack the password if the hacker has your multiple passwords. This is very possible since you are sticking to the same algorithm for every website but you don't know which website will just store the plain text of the password. One can easily link you among different websites with your user…
This threat only holds for dedicated attackers.
1. They have to have multiple passwords to have a chance to derive the algorithm.
2. They also need to somehow think it's worth their time to reverse the algorithm instead of just going with lower-hanging fruit.
Re: Password Algorithms
#25> Your algorithm should always generate complex passwords. Try to include at least one number, one capital letter and one special character. This is one of the big problems with an algorithm. You'll eventually come across a site that -- for whatever reason -- doesn't allow that particular special character (or has a length restriction, or something else that makes your algorithm break). Now what do you do? I use a pa…
How often do you find yourself in a situation where you need to enter a password, but you don't have the password manager on that device? Algorithms have their downside, sure, but for someone like me who is often working on other computers that aren't mine, managers are a non starter.
Consider some portable password manager stored on a usb drive.
Re: Password Algorithms
#26Use a random password and secure generator.
If you like terminal commands, here's one way:
LC_ALL=C (Choose the character set and length as you like. We like to use 32 characters picked from 16 lowercase letters. This is because it's a good balance of bit strength, fast typing for mobile devices, and full mappability to hexdecimal when we need it e.g. to prove exactly 2^128 bit strength or for compliance with HIPAA, FERPA, etc.)
Re: Password Algorithms
#27Re: Password Algorithms
#28I'm not sure why Password Algorithms are rising in popularity. We refute them every time they come up. They don't work. They work UNTIL one of your passwords gets compromised. Then you're stuck either rotating one of your passwords and remembering which one(s) have been rotated, or you're stuck rotating every one of them.
I wrote this page to be a guide to friends and family, but I feel like I end up linking to the refutation of PA's more than anything else:
Re: Password Algorithms
#29The problem is passwords, so long as we have passwords we are going to keep talking about password algorithms, password managers, password strength, password requirements, lost passwords, stolen passwords, phished passwords, forgotten passwords, expired passwords and all that crap.
My startup is working on killing the password. What if we don't need passwords EVER? No need to argue about algorithm, strength, reset, lost, stolen, forgotten and expired passwords.
This is the problem I'm currently working on. Oh yeah, I did apply to YC and got rejected. Anyways, I'm in the early stages but plan to be shipping within the next 4 months. If anyone is interested in beta testing when I reach that stage please ping me.
Re: Password Algorithms
#30Earlier quoted context omitted.
* Your password must be between 7 and 20 characters * Your password must contain * At least one number * At least one upper-case letter * At least one symbol from this list (!@#$%*) * Your password must be changed every 30 days Plus this: https://blog.mamota.net/resources/img/wat_2.gif
Heh, our HR system had a following requirement: - password must be between 7 and 8 characters long - has to include one number - has to include one of the following: $#!*, no other special characters are allowed It was so horrendously bad it's not even funny.
> password must be between 7 and 8 characters long
How do you enter a fractional character?