News for hackers. Stuff that matters.

A comment on The war against autocomplete=off (2013). Parent comment

Re:The war against autocomplete=off (2013) by ToastyMallows on Friday March 14, 2014 @03:37PM (#7401250)
I changed all my passwords recently to do the same thing. The problem I've recently started to see is that, let's say for example my hashed+salted password is stolen from a site. If they brute-force figure out what my password is, they'll have my "base word" and all my other accounts may still be able to be compromised.

Recently I changed my big accounts (Google, Facebook, StackOverflow) to have a slightly different "base word" and the other accounts that I can afford to lose control of have stayed the same.

[ Parent | on HN ]
Re:The war against autocomplete=off (2013) by smileysteve on Friday March 14, 2014 @05:28PM (#7402020)
It's significantly more difficult to reuse the base and figure out the additional characters than it is to get access to the user whose password is 'password'

For insecure services that I use on mobile, public, etc computers, I do this.

[ Parent | on HN ]