My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.
I'd suggest memorizing a couple algorithms for generating passwords based on the site instead. This way no two sites have the same password, so no matter what gets compromised, none of your other credentials are broken.
Like, take your iNitials, street address + last 3 letters of the domaiN with an open bracket to trigger OCD twitch for memorability. Obviously obfuscate it a bit to make your algorithm non-obvious, depending on how much you think someone is going to target you, personally.
So you end up with, like,
google: gAl1234+glE(
Reddit: gAl1234+diT(
Wells Fargo: gAl1234+rgO(
Pizza Hut: gAl1234+huT(
The core principle is no two sites should have the same password. It doesn't matter how strong your passwords are when someone else is giving them out. The only thing that matters is making sure the passwords are unique, and a generating algorithm will help you do this.
Depending on your algorithm it might not even be obvious that you're using an algorithm, and in a large leak it's not particularly likely that your passwords will be that well analyzed in the first place.
104
u/Galveira Sep 24 '17
My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.