A variation on the password algorithm: Generate half of your password by using the algorithm. Create the other half, one per site, using a random algorithm, and write it on a piece of paper (if the site has stupid "security" requirements for the password, you can usually fit these into your random string).

To regenerate your passwords, an adversary would need both to figure out your algorithm and obtain your piece of paper.

If you're already writing half the password on a piece of paper wouldn't it be safer to generate the whole password randomly and write that down?

If only half the password is written down, anyone who obtains that paper without knowing the algorithm only knows half the password!

Oh, that's right, thanks!

Or, you know, use a password manager.

Which password manager is the most secure / robust / potentially long lasting company out of: LastPass, 1Password, Dashlane, Keeper (or others?)?

I use LP, I also used 1Password professionally and I found it cumbersome but your mileage might vary. I disliked Dashlane and never used Keeper. They all do roughly the same thing, the difference is in UI mostly, just test it out and see what you like best.

Password algorithms, aka deterministic password managers, are usually pretty strong, specifically as strong as the master password(s) you use. Meaning that it’s usually easier to guess the mp than to reverse the algorithm.

Personally, I have different mp for different “security domains” (google/fb, banks, other socials, ...), and I’m using just a sha256 plus encoding — a trade off between requiring a stronger mp, and being able to easily remember everything, including the algorithm.

I wrote more about it here: https://hackernoon.com/mempa-a-modern-deterministic-password...

Ew. Friends don't let friends use low-entropy passwords.

"Password Strength" https://www.xkcd.com/936/

Diceware: http://world.std.com/%7Ereinhold/diceware.html "This page offers a better way to create a strong, yet easy to remember passphrase for use with encryption and security programs. Weak passwords and passphrases are one of the most common flaws in computer security. Take a few minutes and learn how to do it right."

As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this?

I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get 3-4 of the services I use, and even then they'd need to find each of those services out of the hundreds I use. I also have 4 different emails I use for logins.

Most password managers provide apps and syncing, and are often integrated into your browser, so everything is a click away. Having to juggle 4 emails, remember which of 5 passwords a site uses, and figure out your exposure in case of a breach seems a lot harder than the above.

I happen to use the open source password manager from Keepass.info. It works on a local password file protected by strong crypto. Then, I use Dropbox to sync that file from device to device.

The problem with using the same password on multiple sites is this: if any one site gets pwnd, it gets a lot easier for the cybercreeps to pwn your account on other sites (says Obvious Man).

It doesn't take much technical skill to credential-stuff--to hammer a lot of sites with a list of credentials. So, keeping the list of sites you actually use a secret is not effective.

This whole deal sucks. But it's real.

Personally, I use LastPass across browsers in multiple desktop accounts and my mobile browser, with no issue. You create a LastPass account, presumably with a very secure password, that you can log into elsewhere.

As for the password strategy, I imagine you could be vulnerable if any two important accounts - say, email and bank - both used the same password. Are you confident this is not the case?

I assume certain emails associate with certain types of accounts, which could flaw your strategy. If you're able to remember ~15 different passwords with random emails, congrats on your stellar memory!

I use Google Smartlock, and it functions across all my (android) devices quite well. It does sort of rely on your being all-in on the Google ecosystem. At work we use LastPass, but since I only use it on the desktop in a browser I can't speak to how it works across devices.

LastPass works for multiple devices, including mobile - you can sync to 1 LastPass account, too.

Does smartlock work with native mobile apps (which may or may not use magic webviee for auth), or is there a way to manually transfer password to log into an app?

Password managers across devices:

Either use a service that syncs up to a server, or a standalone apps and save its encrypted database to a shared filesystem such as Dropbox or pcloud.

As long as you don't care if at most 4 of your accounts get hacked, then you have an effective strategy, I guess.

>The trade off: your algorithm probably sucks

I suspect most people will end up having weak algorithms the same way they have weak passwords.