News for hackers. Stuff that matters.
Re:"Pwned Passwords" V2 With Half a Billion Passwords by ythn on Wednesday February 21, 2018 @03:38PM (#16432767)
Algorithmic password in your head, with a google spreadsheet to keep track of usernames, password rules, etc. on a per site basis (i.e. "bankofamerica, [email protected], 4-12 characters - no special).

Edit: downvote away, but so far no one has ever been able to give a compelling reason why algorithmic passwords are bad. It has tradeoffs, sure, but so do password managers.

Re:"Pwned Passwords" V2 With Half a Billion Passwords by pbhjpbhj on Thursday February 22, 2018 @10:12AM (#16438036)
If a couple of your algorithmic passwords get leaked, attached to same email, then the algo could be guessed and you potentially lost all your accounts.
Re:"Pwned Passwords" V2 With Half a Billion Passwords by ythn on Thursday February 22, 2018 @11:51AM (#16438961)
That's a lot of unlikely ifs. And that also assumes my algo is easy to reverse from 2 digests. My counter to that is that it is unlikely anyone would specifically target me and waste resources trying to crack my algorithm when there is so much low hanging fruit elsewhere. If I am specifically being targeted, I've probably already lost, even if I use a PW manager.

Compare to PW managers: "If your password db and master password get leaked, attached to the same email, then you lost all your accounts." Also with PW manager, losing your phone can mean Denial-of-Service to all of your accounts if you are i.e. travelling.

Re:"Pwned Passwords" V2 With Half a Billion Passwords by pbhjpbhj on Thursday February 22, 2018 @11:56AM (#16439010)
Other methods being poorer doesn't make your method objectively better. You're probably right on low-hanging fruit, all depends on your threat model I suppose.

Don't password managers have 2FA, and alternate phone numbers?

Re:"Pwned Passwords" V2 With Half a Billion Passwords by ythn on Thursday February 22, 2018 @12:37PM (#16439415)
There is no method that is objectively best. Every single current method has tradeoffs. Being cumbersome to setup/use/recover is a big tradeoff of PW Managers.