No special characters in passwords is one of my biggest pet peeves. It really screws up my general system for generating passwords for different sites.
You use a deterministic system for generating passwords based on site? That seems only marginally better than just using the same password everwhere...unless you're doing something like using a consistent secret key to encrypt some function of the site name with AES, and using the result as your password.
I disagree. Just using a tiny variation, like adding the length of the website's name at the end, will be enough to defeat any automated system. Even for a human, figuring it out would require cracking several websites and a lot of brain cycles to spend on his particular account.
Well, if he used the same strong password everywhere, it would still defeat any automated system. The reason you don't use the same password everywhere is in case someone decides to try it with your email address in a bunch of different places.
If I found his password for this site was hunter2HN, I'm pretty sure I could guess his Facebook password...
Comments
No special characters in passwords is one of my biggest pet peeves. It really screws up my general system for generating passwords for different sites.
You use a deterministic system for generating passwords based on site? That seems only marginally better than just using the same password everwhere...unless you're doing something like using a consistent secret key to encrypt some function of the site name with AES, and using the result as your password.
I disagree. Just using a tiny variation, like adding the length of the website's name at the end, will be enough to defeat any automated system. Even for a human, figuring it out would require cracking several websites and a lot of brain cycles to spend on his particular account.
Well, if he used the same strong password everywhere, it would still defeat any automated system. The reason you don't use the same password everywhere is in case someone decides to try it with your email address in a bunch of different places.
If I found his password for this site was hunter2HN, I'm pretty sure I could guess his Facebook password...
You can just "describe" your password for the special-character-impaired:
#(%$^ -> hashleftparenpercentdollarcaret
Probably a might bit harder to crack, too.
Not when they limit you to 8 characters. :)