I currently use the following method to generate a different password on every website I have to login:
password = SHA1 ( mainPassword . domainName . number )
. stands for concatenation.
Here are my questions:
- Is this secure enough?
I mean, if somebody knows my algorithm and one or many passwords, could he find easily one of my other passwords? Up until now, most people I contacted believe it is true, but I didn't get any real strong certitude.
- (Related to question 1) When one of my passwords is compromised, I just increment the number. Is this enough?
Now, as many people suggested, SHA-1 can be a bit too weak and many proposed to use bcrypt or even better scrypt. But, as I understand these two algorithms, it is more about encrypting than hashing. Is it secure to use the following passwords?
SHA1( SHA1( … SHA1( str ) … ))
Here is my reasoning:
- It is difficult to retrieve
- I hope that to retrieve
sha1(sha1(str))one must do twice of the work.
- Therefore retrieving
(str)should be n times as difficult than to retrieve
I am almost sure there won't be any proof of this. But could I consider this method safe enough?