Generating passwords from a master password using rules

Question

I realize it's generally considered bad idea to use the same password everywhere.

I can use icloud / lastpass to generate my passwords for me, but that leaves me clueless when I don't have access to these services, or attacks to those services.

Does it make sense to use 1 "master password", but modified for each website / service with set of rules?

For example, let's make my master password foobarone and name of the service is "facebook". My rule is to shift 1st letter X. Where X is number of first letter in service name (facebook, first letter is f, f = 6). Therefore, I am shifting 1st letter by 6, so my final password for facebook is loobarone. In reality, these rules would be more complicated.

Does this provide me layer of security, or is my thinking out of line and the only solution is to have random password for every service?

Answer 1

The reason reusing passwords is a bad idea is that the security of all your accounts relies on the security of the weakest account which uses the same password. If you sign up for PNC Bank and [favorite show here] Fan Club using the same password, one of them being compromised will compromise them both.

That being said, under the assumption that one of these services will be compromised eventually, the security of them relies on the security of your scheme, rather than the master password itself. If all you're doing is changing the first letter, then it is trivial to guess it given a leaked password.

A better method could be using some variant of HMAC to combine your master password with the website's domain name.

HMAC_MD5("foobarone", "facebook.com") = "b5bda098afd19b1f7992abfa9ab7d710"

You could then use "b5bda098afd19b1f7992abfa9ab7d710" as your password for facebook. For convienience, you could truncate it to "b5bda098afd19b1f" and still have a relatively strong (64 bit) password.

Using LastPass (or some other manager for that matter) is better than using a homemade system, though.