News for hackers. Stuff that matters.
Re:We're Baking ‘Have I Been Pwned’ into Firefox and 1Password by djsumdog on Tuesday June 26, 2018 @09:03AM (#17400218)
I still use a pretty complex password algorithm:

https://penguindreams.org/blog/password-algorithms/

I like not having my passwords tied to a device, private key I could lose, etc. With an algorithm, I can still avoid credential stuffing, since all my account use totally different secure passwords, but I can derive them without having to look them up.

I realize someone could figure out my algorithm, but they'd probably need several of my passwords and at that point you're talking about a targeted attack.

Re:We're Baking ‘Have I Been Pwned’ into Firefox and 1Password by ISL on Tuesday June 26, 2018 @09:20AM (#17400327)
What do you do when you're asked to rotate your password every ninety days?
Re:We're Baking ‘Have I Been Pwned’ into Firefox and 1Password by djsumdog on Tuesday June 26, 2018 @04:27PM (#17403729)
Most normal websites don't make you rotate password. When a site has a breech and forces me to change it, I do have an addition to my algorithm for that. I use Keepass to store passwords that violate my algorithm (sites that don't allow my special chars, or that say my password is too long, etc.)

I'm on my third iteration of password algorithms. I use my password manager to store which algorithm I'm using for which site and try to update old ones to new ones as I encounter/use them.

There aren't that many exceptions to my rules, so I can usually remember those exceptions if I use them frequently enough.

Machine accounts that require rotation get their own special secure password that I don't use anywhere else.

Re:We're Baking ‘Have I Been Pwned’ into Firefox and 1Password by michaelmior on Tuesday June 26, 2018 @01:58PM (#17402722)
Not the parent, but I've haven't been asked this in years. I do periodically change important passwords, but I can't recall being forced to.