Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You don't need to trust others. For example, build the password using some simple algorithm that uses the TLD name. This way you only need to remember the algorithm.


I used to use this system but moved away from it. The reason is twofold. First, if it's a simple enough algorithm there will be enough 'hash collisions' that if someone gets their hands on one of your passwords and your email address, there's a non-negligible possibility that they will be able to find another domain that has the same password.

Second, sometimes sites mandate that you change your password. Or have rules that are incompatible with that algorithm. And then you need to start remembering exceptions to your algorithm, at which point you're back where you started.


There's also https://lesspass.com/ which is stronger than what the parent mentioned and I used a system like that for several years.

I gave up on it for the same reason. Having to remember exceptions, plus when you change your password, you have to change it everywhere, which is annoying because you can't remember every active account.


The problem with that is many sites have password requirements which requires password to be of a certain length and some arbitrary requirements.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: