>Your email address, in most cases.
I have accounts with, like, a bazillion different financial institutions. They all require user names that have length requirements and special character/number requirements. I would forget all my user names if it weren't for password managers.
If you have one bank, no 401k, no IRA, no credit cards, two social media accounts, one email address, and do all your online shopping on Amazon, and not much else this sort of disadvantage won't pop up but once you get into multiple accounts on multiple sites it does not scale.
If you have many password schemes you'd also have to remember the password rules for every single site.
1) go to site 2) enter email address (cached by the browser) 3) go to email account 4) click on long, unguessable link which is only valid for 2 minutes)
er..that's it.
You could even skip the `enter email address` step and just get users to keep a link provided in the initial signup process. This link could either be the one you always use to log in, or for better security could prompt the remote site into sending you another single-use login link (as above).
I use keepass, but sometimes for services that I use once per year, I just go via password reset and change password to a long random gibberish and do not even bother to write it down to keepass.
Fair point but often there are not too many possibilities.
What is my username
Your email address, in most cases.
My password is too long. My password is too short. My password has the wrong characters. My password does have enough numbers. My password doesn't have enough special characters. My password has too many numbers. My password had too many special characters.
Occasionally a problem, but I have been using this method for years and have maybe two or three passwords that I have to manually remember for reasons like this.
If you are specifically targeted they can compare your password in two hacked databases and find out your scheme.
True, but then one can similarly come up with scenarios for most other schemes.
I agree it's not perfect and won't cover every case, but it has worked well for me.