4
$\begingroup$

I realize it's generally considered bad idea to use the same password everywhere.

I can use icloud / lastpass to generate my passwords for me, but that leaves me clueless when I don't have access to these services, or attacks to those services.

Does it make sense to use 1 "master password", but modified for each website / service with set of rules?

For example, let's make my master password foobarone and name of the service is "facebook". My rule is to shift 1st letter X. Where X is number of first letter in service name (facebook, first letter is f, f = 6). Therefore, I am shifting 1st letter by 6, so my final password for facebook is loobarone. In reality, these rules would be more complicated.

Does this provide me layer of security, or is my thinking out of line and the only solution is to have random password for every service?

$\endgroup$
3
  • $\begingroup$ Cross-site duplicate: Is it a good idea to have a “master” password? $\endgroup$
    – Artjom B.
    Jan 29, 2016 at 22:44
  • $\begingroup$ Although this is on topic here, I don't think we should encourage dupes. I think the question should be closed unless it is made specific to a cryptographic algorithm to perform the derivation. $\endgroup$
    – Maarten Bodewes
    Jan 30, 2016 at 11:23
  • $\begingroup$ See passassin.com which works in a similar manner, but uses an HMAC to generate the passwords. $\endgroup$
    – fadedbee
    Jun 13, 2019 at 11:12

1 Answer 1

5
$\begingroup$

The reason reusing passwords is a bad idea is that the security of all your accounts relies on the security of the weakest account which uses the same password. If you sign up for PNC Bank and [favorite show here] Fan Club using the same password, one of them being compromised will compromise them both.

That being said, under the assumption that one of these services will be compromised eventually, the security of them relies on the security of your scheme, rather than the master password itself. If all you're doing is changing the first letter, then it is trivial to guess it given a leaked password.

A better method could be using some variant of HMAC to combine your master password with the website's domain name.

HMAC_MD5("foobarone", "facebook.com") = "b5bda098afd19b1f7992abfa9ab7d710"

You could then use "b5bda098afd19b1f7992abfa9ab7d710" as your password for facebook. For convienience, you could truncate it to "b5bda098afd19b1f" and still have a relatively strong (64 bit) password.

Using LastPass (or some other manager for that matter) is better than using a homemade system, though.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.