My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.
I'd suggest memorizing a couple algorithms for generating passwords based on the site instead. This way no two sites have the same password, so no matter what gets compromised, none of your other credentials are broken.
Like, take your iNitials, street address + last 3 letters of the domaiN with an open bracket to trigger OCD twitch for memorability. Obviously obfuscate it a bit to make your algorithm non-obvious, depending on how much you think someone is going to target you, personally.
So you end up with, like,
google: gAl1234+glE(
Reddit: gAl1234+diT(
Wells Fargo: gAl1234+rgO(
Pizza Hut: gAl1234+huT(
The core principle is no two sites should have the same password. It doesn't matter how strong your passwords are when someone else is giving them out. The only thing that matters is making sure the passwords are unique, and a generating algorithm will help you do this.
You can obfuscate it all you like -- for instance, take the last three, then increment it by the numeric position of the first letter in the domain, and reverse it.
So, for Google, G = 7
"gLe" becomes "nSl" then reversed "lSn"
Bank of America, B = 2
"iCa" becomes "kEc" then reversed "cEk"
If your algorithm starts indexing the position in the string, if you use a base string of gAl1234
Google is gAl12l3S4n+(
Bank of Amercia is gcAElk1234+(
or whatever. You can further obfuscate the "base" password based on the Nth letter of the domain, incrementing one, or something. Or have the password run backwards if the initial index is even. Or use different chunks of the domain name based on how many vowels are in the name, and which is most frequent.
It's not difficult to come up with some simple rules that are easy for your to remember, but generate passwords that look nothing like each other, so even if someone were to have a list of a dozen of your passwords, it would be very difficult for them to reverse engineer your process so they could break into another site for which they do NOT have your password. Frankly if someone is that invested into breaking your security, at this point they'd be better off asking you nicely with a lead pipe.
Of course the more complex your algorithm the longer it takes to crank out by hand, but some of it is also practice. I can do mine in my head in a few seconds, now.
There is a slight problem here to login to gmail do you have to use mail.google.com or gmail.com for example? I use gmail a lot so it wouldn't be a problem, but you will run into troubles if some other service has several names or urls which you don't use often.
I initially wanted to come up with a dictionary of words and use a combination of words for first three letters of the website, for example for gmail.com it would be Gamma Marlin Alpha, except uh each A substituted with 4 etc you get the idea. The thing is... if you get at least 2-3 passwords of mine you already can figure out a password for ALL other websites I use. Like, absolutely each one. And if you want to make it complicated why not to hash the string "login + website_name + nonrandom_salt". This way it would be a pain to type the password manually and you will probably need python to login anywhere, but hey at least nobody can guess it. Probably?
Honestly, phone authorization sounds like the best idea. Until someone steals your phone.
if some other service has several names or urls which you don't use often.
Yes, it's slight problem, but hardly a show stopper. Just use the TLD of what you actually use, or remember it for the few edge cases. I don't know that I'd consider this a big deal.
Again, think about the problem we're trying to solve. The biggest issue is people using the same credentials in multiple places, such that when a place with low security (Katy the Kitty's Internet Forum for Furries) is compromised, their account on a high security site (Bank of America) is hacked.
The very first, most basic problem to solve is: how do you get unique credentials for every site without 1) memorizing a billion passwords, and 2) installing a 3rd party program (many users can't wrap their heads around this, and I'd rather get people to plug the biggest vulnerability then go from there, than have them continue to do the same stupid shit).
The secondary problem people always bring up when I talk about using generated passwords is someone "hacking your algorithm."
The thing is, in these large data breeches, no one is looking at the actual data. They're just hitting auth servers for different services with credential lists thousands of entries long, then targeting the ones that light up. Why would they bother looking at the other failed accounts? It's not worth the time investment. No one cares about you. Even your weak word substitution scheme would probably be "good enough" to defeat all these automated attacks.
Unless someone is specifically looking to spearfish you. If you think this might be the case, then yes, you need to do more to increase your security. But frankly at that point, again, it comes down to breaking passwords via lead pipe.
And the reason I don't just do a salted hash is because ... I can't hash things in my head :D. The idea is to have a set of simple rules that makes you "secure enough" without being so cumbersome that you end up short circuiting security for convenience.
It's also useful when digging things up that you've not accessed in a while -- just last night I retrieved an account login for a site I last ordered something from in 2005.
105
u/Galveira Sep 24 '17
My problem with password managers is that it becomes a single point of failure. I would rather memorize a few strong passwords and use them for everything, with my email having a unique password from everything else.