Please bear with me on this, I'm not learnt in this field, just trying to ask questions about the security of my encryption method.
I'm trying to create a mentally computable human password manager method that can generate strong passwords using a set of operations and a master password, so that you only have to really remember one password to have strong passwords for all your accounts. And also to never have to change the system in your life so you can have backwards compatibility. The system will work even when everything has been exposed to a public. My desire is to have the system be intuitive and user friendly (instead of having to put effort into memorizing 1pad charts, etc.) yet secure.
I had some feedback elsewhere that my system outputs strong passwords against normal attacks but is vulnerable to a determined adversary, so now I made some changes.
For the sake of simplicity, I will be using weak passwords, but bear in mind it doesn't take that much to obfuscate the final output with scrambling, numbers and symbols.
So, I have a string of 34 letters, each letter representing a word that starts with said letter. That is my master password.
Let's begin with making a Google account:
1. Google
First, I take the word Google to apply the seed G = 7th letter of the alphabet (position) Google = 6 letters (length)
2. GoogleLydngr
Then, I add the 6 (length) letters after the 7th (position) letter of the master password
3. GoogleLydAroundngr
At this point, the last letter "r", represents a word which has 3 letters I move back 3 spaces and add the word "Around", which is the next letter/word after the "r"
GoogleLydAroundngr
So that will be my password for Google. This example is easily bruteforced but my question isn't about the password strength but more of the concept.
Now I create a Facebook account, using the same system:
FacebookGlAndydngra (6 position, 8 length)
You will notice the difference is the letters and number of letters, and that I moved back 6 spaces instead of 3, and has added "And" instead of "Around".
I create 3 more for Instagram, Twitter and Microsoft:
InstagramDngrNeveraadyn (9 position, 9 length)
TwitterNgraNeverady (20 position = 0 = 10 position, 7 length)
MicrosoftYungRunlydng (13 position = 3, 9 length)
So, you hacked my accounts through a keylogger, and got a hold of all my passwords. Also, you discover my order of operations. And finally, I wrote down my master password in a text file, so you know that too. I lose everything.
But I go ahead and create new accounts using the same system. However, I change the master password.
How easy is it to crack my new accounts just based on the fact you know everything now... except for my new master password?
For anyone who's curious, the master password is Nggyunglydngraadyngmycngsgngtalahy
Never gonna give you up
Never gonna let you down
Never gonna run around and desert you
Never gonna make you cry
Never gonna say goodbye
Never gonna tell a lie and hurt you
But seriously, this is a serious question. I'm trying to use the chaos of language and musical timing to generate more variety in place of complex calculations. But I'm not smart or educated in this field to know how flawed my system is.
And just another tidbit, one song alone can generate several passwords for when I need to change a single password exclusively, all I have to do is use a different verse of the song or use syllables instead, or something.
Thanks and appreciate any help or comment given.