Why your tiered password scheme is flawed, and what to do about it.

Re:Why your tiered password scheme is flawed, and what to do... by katamole on Friday February 27, 2009 @10:19AM (#497264)

Sounds like if I were targeting your accounts specifically, I'd have a pretty easy time of it. As soon as I get hold of one or two of your passwords I can work out the algorithm and then start calculating your passwords myself.

While it might be a better approach than just using the same insecure password on every site, based on the attack suggested in this article, there isn't much benefit from your approach.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by tptacek on Friday February 27, 2009 @11:41AM (#497339)

Luckily nobody is targeting his account specifically. The original point, that your low-value passwords can be harvested, is I guess well-taken. But you're pushing it.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by tjogin on Friday February 27, 2009 @12:58PM (#497443)

I don't think you could work out the algorithm, because it's not mathematic. It's a handful of quirky arbitrary rules.

But hey, give it a shot; here are three random passwords (calculated using a slightly different algorithm than the one i actually use):

hotmail: 3m4m349 facebook: w45c033 aol: t41m325

Now, tell me what my Gmail password is.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by jfornear on Friday February 27, 2009 @05:23PM (#497742)

is your hotmail password a typo? should it be m34m349?

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by tjogin on Saturday February 28, 2009 @04:37AM (#498125)

Nope. But it could have been if for a different service/purpose.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by katamole on Friday February 27, 2009 @01:07PM (#497453)

I would never try and second guess somebody who describes himself as "Devil's Advocate Extraordinaire."

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by tjogin on Friday February 27, 2009 @04:10PM (#497670)

I thought you said you'd have a "pretty easy time" figuring it out?

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by katamole on Friday February 27, 2009 @05:15PM (#497730)

If it was a simple algorithm, yes. I believe you have missed the humour, so let me make this clear: I have absolutely no interest in your passwords.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by tjogin on Saturday February 28, 2009 @04:40AM (#498126)

It is very very simple. Just arbitrary and not (entirely) mathematical.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by axod on Friday February 27, 2009 @12:15PM (#497370)

if the algorithm is something like:

password = sha1(masterpw1 + sitename + masterpw2)

I'm not sure you can deduce masterpw1/2 from a few passwords.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by katamole on Friday February 27, 2009 @01:03PM (#497448)

Yes, I'm sure he does that in his head.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by axod on Friday February 27, 2009 @01:56PM (#497506)

heh ok I missed the 'in my head' bit. I just use a simple script to generate passwords.

[ Parent | on HN ]

Re:Why your tiered password scheme is flawed, and what to do... by tjogin on Friday February 27, 2009 @12:58PM (#497444)

To each his own, but in my case I can calculate mine in my head without any assistance of any tool of any kind.

[ Parent | on HN ]