I use the uniqueness of the website name as the primer of the password plus a little more stuff.
I am the only one that knows the key.
I have never forgotten a password since I adopted it.
I use the uniqueness of the website name as the primer of the password plus a little more stuff.
I am the only one that knows the key.
I have never forgotten a password since I adopted it.
One way to address this vulnerability is to use unique email address for each web site. There are mail forwarding services like spamgourmet.com which allow you to create unlimited email address that are forwarded to your main address. For example, I might have my email on this site as sdmb.20.filmore@spamgourmet.com and facebook as facebook.20.filmore@spamgourmet.com. Mail addressed to either address will be forwarded to my main account.
Some email services allow you to create different versions of your address. For example, gmail will allow you to add +anything to your email address. For example, both filmore+sdmb@gmail.com and filmore+facebook@gmail.com are valid address for filmore@gmail.com.
Using techniques like these mean that you won’t have the same email address across multiple websites. In addition, if you start getting spam addressed to one of your custom address, you can disable or direct that mail to go to the trash.
I pick a random object in my office and describe it.
BrownChairFourLegs was my last password.
I use a sentence with a name and number. It’s pretty easy to remember a sentence. For example “Brad Pitt is a 10 on the hotness scale” is “BPia10oths”.
Obligatory XKCD refer…
Oh, wait. Never mind.
If you do that for every single password, you are eventually going to have to write them down. And if you have to write them down, then a simple system like that isn’t any better than “true” random characters.
Before I abandoned writing fiction, I would use a password based on the first sentence of whatever story I was working on, taking the first letter of each word and changing a few to @, $, 0, and so forth. Nowadays it’s poems.
This has the same problem that “user@website1234” as a password has. It’s easily predictable, so it doesn’t really give you any additional security if you use it in that predictable way. And user names are generally stored in cleartext in a bunch of places, so trying to add security to them is misguided.
The purpose of email forwarding sites like that is to figure out who might be selling your email address. Even then, it’s of pretty limited utility, since spammers know that gmail can have “word+” appended to an email address, and they’ll just strip that off before spamming you.
The way to have secure passwords is to use Keepass (or some other highly-regarded password safe), use it to generate long strong unique passwords for every site, and keep the keyfile protected with a good password. Anything else is a half-measure.