I have an acquaintance that have their own "password system" that involves having a "core" set of characters, plus a few unique characters for each site; Is that system safe?

Submitted ⁨⁨4⁩ ⁨days⁩ ago⁩ by ⁨throwawayacc0430@sh.itjust.works⁩ to ⁨nostupidquestions@lemmy.world⁩

Disclaimer: I use a password manager, so please don’t direct your comments at me.

So I know this person that says they don’t use a password manager because they have a better system like… I’m gonna give an example:

Lets say, a person loves Star Wars, and their favorite character is Yoda. The favorite Their favorite phrase is from The Good Place “This is the Bad Place!”. And their favorite date is 1969 July 20th (first landing on moon).

So here:

Star Wars Yoda = SWYd

“This is the Bad Place!” = ThIThBaPl!

1969 July 20 —> 69 07 20

So they have this “core” password = SWydThIThBaPl!690720

Then for each website, they add the website’s first and last 2 characters of the name to the front of the password…

So, “Lemmy Forum” = leum

Add this to the beginning of the “core” password it becomes:

leumSWydThIThBaPl!690720

For Protomail Email it’s: prilSWydThIThBaPl!690720

For Amazon Shopping it’s: amngSWydThIThBaPl!690720

Get the idea?

The person says that, since the beginning of the password is unique, its “unhackable”, and that the attacker would need like 3 samples of the password to figure out their system.

Is this person’s “password system” actually secure?

source

Comments

Sort:hotnew top

JeeBaiChow@lemmy.world ⁨4⁩ ⁨days⁩ ago
I used to do this. Have a system for generating a unique password for each site. But then one site got hacked and I had to reset my password, and I couldn’t use the old password. So I had to make a new system. You see the problem.

source
- Takapapatapaka@lemmy.world ⁨4⁩ ⁨days⁩ ago
  A solution to this is to keep adding elements to the chain to create a new password. Like your base password is FavouriteCharacter2025siteletters, and if you need to change it, go for FavouriteCharacter2025siteletters!!!
  
  If you add the same element across accounts when you need to change a pw, it’s still easy to remember, just a few more try when you forget it, it’s still useful against database leaks, and it’s not worse when it comes to targeted hack.
  
  source
  - bamboo@lemmy.blahaj.zone ⁨4⁩ ⁨days⁩ ago
    How many sites are we talking about? I have like 600 passwords in my password manager, it would be insane to try to remember each of the rules for when I changed the password last.
    
    source
    -> View More Comments
- rumschlumpel@feddit.org ⁨4⁩ ⁨days⁩ ago
  That doesn’t really answer the question though, you just assumed that attackers would instantly figure out your system with a sample size of 1. How do they do that? Not saying that they definitely can’t, but I want to see logical arguments before I believe it.
  
  source
  - cRazi_man@lemm.ee ⁨4⁩ ⁨days⁩ ago
    That’s not the punt they’re making at all.
    
    The point of that when a website password breeds to be changed, then it won’t conform to the system anymore. Now you need to make a new system, or remember this particular exception.
    
    source
    -> View More Comments
  - JeeBaiChow@lemmy.world ⁨4⁩ ⁨days⁩ ago
    It’s not about being safe. It’s about losing track of your ability to track your unique passwords once one site nullifies it’s password.
    
    source
BillDaCatt@lemmy.world ⁨4⁩ ⁨days⁩ ago
There are two answers to your question.
Most password cracking operations target a database of user accounts in bulk. As long as the hacker is not targeting your friend specifically, they should be fine.
If your friend is the target, one or two successful hacks could make their other passwords vulnerable.

source
Ek-Hou-Van-Braai@piefed.social ⁨4⁩ ⁨days⁩ ago
You can buy leaked passwords from the dark web if you know someone's email.

So if someone got say 5 passwords from this person and look at them they'd very quickly be able to figure out the pattern and would know all their passwords.

The method they use is safe from scripts etc. But not foolproof

source
9point6@lemmy.world ⁨4⁩ ⁨days⁩ ago
I used to use a similar system until I switched to a password manager. Convenience is a big factor, it’s nice to not have to think about logging in. Also coupled with that a secure password is a long password, so not having to type it in is a bonus.

The person says that, since the beginning of the password is unique, its “unhackable”, and that the attacker would need like 3 samples of the password to figure out their system.

I’ve had my data leaked more than 3 times, it’s not an unlikely scenario that someone could get a list of passwords used by someone.

Also once their system is compromised, they have to come up with a new system, then go and change every password. Which if it was me would be hundreds of places. With a password manager there’s no reason not to have completely unique passwords for everything, so if there is a leak, oh well, just change that password.

source
Zwuzelmaus@feddit.org ⁨4⁩ ⁨days⁩ ago
Know your enemy:

Dictionary attacks

Leaked passwords

Password guessing attacks

Your “system” is good against 1. but vulnerable against 2., and a bit vulnerable against 3. because of the system.
source
Brkdncr@lemmy.world ⁨4⁩ ⁨days⁩ ago
It’s safe until you’re targeted.

source
- uranibaba@lemmy.world ⁨4⁩ ⁨days⁩ ago
  From what I understand, they (hackers) try known email/password combinations at different sites because a lot of people reuse their passwords. I also find it unlikely that anyone trying hack accounts will spend any amount of time looking at individual passwords if their list is 1000+ (and we know there are leaks in the milions).
  
  I agree that they are reasonably save unless they are targeted.
  
  source
  - hperrin@lemmy.ca ⁨3⁩ ⁨days⁩ ago
    The problem is that it’s a common suffix among all of their passwords. That kind of thing is easy to search for in a password leak database.
    
    source
yesman@lemmy.world ⁨4⁩ ⁨days⁩ ago
This system is fine. While patterns are obviously easier to hack, having unique passwords for each site and being able to remember them puts your friend in the 90^th^ percentile of computer users.

source
null_dot@lemmy.dbzer0.com ⁨4⁩ ⁨days⁩ ago
I reject the premise!

There is no safe or unsafe. It’s more like “more safe for a given person”.

Your friend’s system is better than using the same password everywhere. It’s more difficult to hack than the majority of passwords that aren’t generated by password managers. If that’s what your friend likes and works for them well, fine I guess.

It wouldn’t work for me because:

it doesn’t input the password for you. Does your friend really type passwords in all the time?

IDK if my memory is particularly bad but having to remember anything at all is hit and miss. Like I could remember those characters that are used everywhere, but for the router at my mum and dads house that I haven’t accessed in 5 years, was it “mums router” or "router mums house"

Also I manage multiple passwords for the same sites, as in credentials for my partner or whatever, but I guess I could make variant of this system.

also if I were to die the person who sorts out all my stuff will have access to my passwords

but the main reason is… I use my keepassxc db as a database for all sorts of things which aren’t necessarily passwords. ssh keys are a good example. I use it for TOTP. bank card details. membership numbers and government ids. VIN numbers for vehicles. Also, a weird one, I have to keep track of about 100 physical keys for reasons, I stamp a number on them like k32 and then store that number and an explanation of what it’s for in my db.
source
F04118F@feddit.nl ⁨4⁩ ⁨days⁩ ago
There’s literally only 4 characters difference between all their passwords, even if those would be completely random, that’s very bad.

They don’t seem to understand that it’s not about how many samples you need to see to be sure what their Amazon password is. The problem is that if one of their passwords ever leaks, some bot can brute-force try thousands of variations on it and find any other password very quickly (they effectively only have to guess 4 characters, plus a bit to find that it’s the first 4 to change).

How can anyone think this is more secure than having completely different and long passwords for every site?

They probably don’t understand that your pw manager’s password is safer because you don’t enter it anywhere, only into your password manager (ideally with 2FA). This person is effectively spreading their master password around by putting it as the core of ALL their passwords, significantly increasing the risk that it leaks.

source
- throwawayacc0430@sh.itjust.works ⁨4⁩ ⁨days⁩ ago
  
  There’s literally only 4 characters difference between all their passwords, even if those would be completely random, that’s very bad.
  
  So the 4 characters is just my way to explain their system, I don’t actually know how many characters they use in their “unique” part of the password, but the idea is that the unique part of the password is derived from the website’s name.
  
  source
  - F04118F@feddit.nl ⁨4⁩ ⁨days⁩ ago
    Obviously random is better, but uniqueness of passwords is IMO even more important. They are effectively spreading around their master password
    
    source
  - Clent@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago
    The relationship is the problem.
    
    Calculating the levenshtein distance is the first thing that comes to mind, then creating a regular expression that covers any leaked passwords tied to the same account.
    
    This is all easily scriptable and two leaked passwords might be all a script needs to discover the pattern. Once the pattern is known, all of their passwords become knowable.
    
    source
hperrin@lemmy.ca ⁨3⁩ ⁨days⁩ ago
It’s probably not safe if they use that for everything. Someone could match emails and password suffixes, then they’d only have four letters to brute force. So all it takes is two leaks that your friend is on and he’s at real risk.

Generally, this would be avoided by whatever site storing their passwords as hashes instead of in plain text, but you can’t rely on that.

They should just use a password manager.

source
- SpongyAneurism@lemmy.frozeninferno.xyz ⁨3⁩ ⁨days⁩ ago
  If they start using Keepass, we now know, their master password will be: kessSWydThIThBaPl!690720
  
  I hope OP just constructed the core password as an example only.
  
  source
halcyoncmdr@lemmy.world ⁨4⁩ ⁨days⁩ ago
For random password dumps going through thousands of accounts it’s probably fine, but if you’re targeted for some reason and they get just a couple passwords. With even just 2 passwords, that system may be obvious already to someone looking to gain access to your accounts specifically.

source
zxqwas@lemmy.world ⁨4⁩ ⁨days⁩ ago
Better than a lot of other methods. What are you protecting, from who and how annoying would it be to recover if it went wrong. I don’t use a password manager because I’d lose the file for sure and it would be just as inconvenient to recover as if someone hacked me. I also don’t have any sensitive stuff. Work on the other hand I have a password manager.

The lowest hanging fruit is using a leaked/hacked/stolen list of accounts/emails and passwords and trying them on other sites. You should be safe from that.

If you have sensitive information someone would be willing to break the law and spend a few thousands of dollars to get you’re not safe.

source
A_norny_mousse@feddit.org ⁨4⁩ ⁨days⁩ ago
I hope you didn’t make their actual basic phrase public.

In my opinion any password that’s designed to be human-friendly isn’t secure. Every crutch one uses to remember it, a machine can make much faster use of.

In this case I’d say the core idea: “SWydThIThBaPl!” is relatively safe, but 690720 is almost immediately recognizable as a date - to a machine! - and amng, leum etc. are even easier assuming the cracking program has knowledge of which site they’re trying to gain access to.

So the only good part is the one that repeats for every password.

I think the top half of this xkcd illustrates some of it; but iirc the bottom half has been sort-of half debunked.

In any case, I use only very long and completely random passwords for online accounts.

Does this person think password managers are crutches? You cannot out-remember a machine.

source
- Blemgo@lemmy.world ⁨1⁩ ⁨day⁩ ago
  I do agree that password managers are generally more secure than memorable passwords, however, they also pose he Achilles heel of a system, as one password unlocks all. That is why 2FA tops everything, as even with a weak password, as a hacker would need to crack an OTP to gain access, or convince the one holding the 2nd device to unlock the account for them.
  
  However I do want to contest the claim that all user-friendly passwords are inherently unsafe. The Electronic Frontier Foundation did a Deep Dive on randomly generated passphrases and shows how secure the system is by entropy alone.
  
  source
- throwawayacc0430@sh.itjust.works ⁨4⁩ ⁨days⁩ ago
  Its an example. Not a real password
  
  If you replace the “SWydThIThBaPl!690720” part with a random string like: dsh2box5hRs3wraA (just generated this), but kept the system the same, would your assessment of this system be different? (Assuming someone can actually remember that string of characters)
  
  source
  - A_norny_mousse@feddit.org ⁨4⁩ ⁨days⁩ ago
    Your new example is confusing. With or without the date?
    
    In any case, what would be the point? “Oh, I can remember the first 4 letters of the password but not the last 20”?
    
    This person needs to understand that they cannot outsmart a machine, at least not in this. FWIW I’ve been using keepassxc for I don’t even remember how many years and never had a problem with it.
    
    source
    -> View More Comments
- nimpnin@sopuli.xyz ⁨4⁩ ⁨days⁩ ago
  
  but iirc the bottom half has been sort-of half debunked
  
  Any source for this? It’s literally just random words. Just pick from a large enough list and you’re good.
  
  source
  - A_norny_mousse@feddit.org ⁨3⁩ ⁨days⁩ ago
    Things a password cracker does before brute force guessing:
    
    Dictionary attacks
    
    Leaked passwords
    
    Password guessing attacks
    
    …
    
    source
    -> View More Comments
TranslateErr0rs@lemmy.world ⁨4⁩ ⁨days⁩ ago
I get the idea as I used to do this too. Having secure & different passwords everywhere is just the basic way to go. As such I dont think though its a good idea to put a system in your passwords. Hacking attempts are automated and getting smarter every day. Its only a matter of time until someone unleashes an AI to look for patterns and you are toast.

I recommend to juse a decent password manager that generates them for you and as much MFA as possible.

source
- kambusha@sh.itjust.works ⁨4⁩ ⁨days⁩ ago
  Just use is now j’use
  
  source
rumschlumpel@feddit.org ⁨4⁩ ⁨days⁩ ago
On one hand, it’s probably not that unlikely that an attacker gets 3 samples if the email or username gets reused a lot, on the other hand I wonder how well automated password crackers deal with systems like this. ‘one good pattern with a couple of extra characters per site’ seems like a pretty common password system.

source
ThatGuy46475@lemmy.world ⁨4⁩ ⁨days⁩ ago
As long as it’s capitalized with a 1! at the end

m.youtube.com/watch?v=z_HmDP3lKMI

source
dwindling7373@feddit.it ⁨4⁩ ⁨days⁩ ago
So, dedicated enough to embrace the importance of a solid password but not humble enough to think he’s got a better system than what everybody else reccomend.

The system is clearly flawed ego wise.

It’s an insafe password + salt.

source
Yermaw@lemm.ee ⁨4⁩ ⁨days⁩ ago
Its secure enough for the average person. If your friend was a big deal, super rich or powerful and a massive target it would be easy enough to figure out.

I doubt it would be worthwhile trying to crack that particular code for the average joe.

source
BananaTrifleViolin@lemmy.world ⁨4⁩ ⁨days⁩ ago
So no this is not safe. Once ypu have a system it is easier to crack because if someone has 2 or more of your passwords they can work out there is a system and it’d make it much easier to crack others if they’re determined.

It is unlikely that someone random would specifically target a person and systematically try and crack their passwords. If that were to happen it’d most likely he someone they know. So while the passwords are definitely flawed it may not be something that anyone takes the time to exploit. But you can never say never.

The best way to manage passwords probably remains a secure password manager and randomly generated series of characters for each site. If its truly random then there are no shortcuts and every single password stands independently. The password manager gets round the issue of memorising them.

source
rottingleaf@lemmy.world ⁨4⁩ ⁨days⁩ ago
A phrase is better:

unlucky friendly monkey got raped by feral donkeys the monkey ran away from donkeys led astray

It’s not very different from a sequence of 13 symbols, but there are many more words in English lexicon than symbols in ASCII plus 10, and the password becomes easier to memorize.

This is also an adaptation of a joke from a Russian cyberpunk novel, one of the last good things by its author, called “Labyrinth of reflections”. It’s still very good BTW.

One my friend has a very good taste in books and poetry, but when you talk to him, you wouldn’t think that. He spews bullshit about “patriotism”, alternative history, “anti-male laws” and such, believes that he can feel energies, and the only way to notice there’s something much better buried underneath is to talk about random life events for long, not trying to fix on anything in particular or reason logically. Yet every book he’s advised has been precious to me.

source
- Tiger@sh.itjust.works ⁨4⁩ ⁨days⁩ ago
  Phrases or words are good, but they should be random - not from known passages in poems, books movies etc, at least not without significant alteration.
  
  source
  - rottingleaf@lemmy.world ⁨4⁩ ⁨days⁩ ago
    Obviously, my point was that remembering a word is easier than remembering a letter.
    
    source
7uWqKj@lemmy.world ⁨4⁩ ⁨days⁩ ago
KeePassXC can tell you if a password is secure (“entropy”, “health check”, they also use an online service to check for leaked/known passwords).

source
- rumschlumpel@feddit.org ⁨4⁩ ⁨days⁩ ago
  I doubt it can figure out whether a password system is secure. I’d be surprised if “leumSWydThIThBaPl!690720” didn’t get a decent score, though.
  
  source
  - Argurotoxus@lemmy.world ⁨4⁩ ⁨days⁩ ago
    I can’t say with complete certainty, but 1password at least does have a flag if I use the same password for multiple accounts. I don’t know if it’d identify this or not
    
    source
- A_norny_mousse@feddit.org ⁨4⁩ ⁨days⁩ ago
  The examples above have 24 characters.
  They report entropy between 119 and 120.
  Completely random examples, A-Z, a-z, 0-9 and only the exclamation mark added, are above 120 across the board, up to 155.
  If I add all other character blocks except extended ASCII, entropy goes up to roughly 135-155.
  If I add in extended ASCII it ranges from 180 to 255, but this can cause trouble on some setups.
  
  Personally I’d never consider such a short password for an online account.
  
  source
Witchfire@lemmy.world ⁨4⁩ ⁨days⁩ ago
No it’s still not safe. The only way to truly be safe is randomized password strings and 2fa (and even then, you’re beholden to the safety of the company)

source
foggy@lemmy.world ⁨4⁩ ⁨days⁩ ago
If it is sufficiently long, and the pattern is in any way dynamic then yes.

If they’re doing something like lemmy-core-420 then no.

A drummer friend used to do a few bars of a different rudiment. Like djddjdjjdjddjdjjdjddjdjjdjddjdjj and then account for PW rules

source
FriendOfDeSoto@startrek.website ⁨4⁩ ⁨days⁩ ago
I would say this system is safe until one password - through no fault of their own - gets leaked. Worse even, two of them. If a bored hacker sees them in a stolen list, they could go to town on all other accounts. So you should advise your acquaintance to change their system. Long passwords are great but if they repeat a lot of characters they are immediately less useful. If the repeating string is known it makes brute-forcing other accounts that much easier.

The best advice is to keep unique passwords for all accounts. And by unique I mean not following a system like that. Long, random, non-sensical crap is best (but also most annoying) - for now. Once quantum computers become a thing, all this probably won’t matter any more.

source
mat@jlai.lu ⁨4⁩ ⁨days⁩ ago
If this person is scared to have password stored, you can talk them about lesspass. It is available as a website where everything happens inside the browser, a browser plugin or an android app and it uses crypto derivation to generate unique passwords for each site.

source
kibiz0r@midwest.social ⁨4⁩ ⁨days⁩ ago
All of security is about trade-offs. “What does it protect me from, and what do I give up to gain that protection?”

If you need to remember a lot of passwords, then having some kind of system makes sense.

But most people don’t need to remember a lot of passwords. Most people can reasonably offload that job to a password manager.

So without knowing anything more, I’d guess it’s not good security for them.

source
LiamMayfair@lemmy.sdf.org ⁨4⁩ ⁨days⁩ ago
That system is vulnerable to social engineering attacks. If hackers found out all their favourite things that lead to the core part of the password, guessing the prefix wouldn’t be that hard. Also, what would your friend do if one of these passwords got compromised and had to change it? Would he just add a 1 to the site-specific part of the password?

source
- sxan@midwest.social ⁨4⁩ ⁨days⁩ ago
  Isn’t every system vulnerable to social engineering hacks?
  
  source
  - LiamMayfair@lemmy.sdf.org ⁨3⁩ ⁨days⁩ ago
    Yeah, but there are degrees of vulnerability. Otherwise, things like password strength or MFA wouldn’t matter.
    
    If all your passwords are fully random, then that’s one less weakness that can be exploited. People can’t make educated guesses about your passwords just from analysing your social media profiles and history, e.g. if you post a lot about Star Wars, it’s more likely your passwords could contain a Star Wars reference.
    
    source
    -> View More Comments
- throwawayacc0430@sh.itjust.works ⁨4⁩ ⁨days⁩ ago
  
  guessing the prefix wouldn’t be that hard
  
  Devil’s Advocate: Most websites have limitations on the number of attempts.
  
  source
  - Tiger@sh.itjust.works ⁨4⁩ ⁨days⁩ ago
    Hackers aren’t always using the login interface, sometimes they’re beyond that and have access to the database of password hashes, and they’re trying to crack the password that can be entered to match a hash and get to try as many times as they like on their own away from the target system.
    
    source