Comment on On cryptography and dogmasparentComments−yogsototh14yHi! As you are an expert in the domain, do you know if my method to generate personal password seems secure?Typically, instead of memorizing a lot of random password, I memorize only one password and for each website I use the password:sha1(password|domainname)Until here nobody give me a clear answer, and therefore I assume it is secure while not any flaw is discovered.And more precisely, I usesha1(password|number|domainname)because, if I fear my password was discovered, I change it by incrementing the number.I would be very grateful if you mind answer my question. Thanks!−JoachimSchipper14yThat's vulnerable to a length extension attack: sha1(passwd|am) can be used to derive sha1(passwd|amazon). (See Wikipedia for a discussion.)Don't try to get clever, just use random passwords.−yogsototh14yThank you so much! It is exactly what I was looking for.
Comments
Hi! As you are an expert in the domain, do you know if my method to generate personal password seems secure?
Typically, instead of memorizing a lot of random password, I memorize only one password and for each website I use the password:
sha1(password|domainname)
Until here nobody give me a clear answer, and therefore I assume it is secure while not any flaw is discovered.
And more precisely, I use
sha1(password|number|domainname)
because, if I fear my password was discovered, I change it by incrementing the number.
I would be very grateful if you mind answer my question. Thanks!
That's vulnerable to a length extension attack: sha1(passwd|am) can be used to derive sha1(passwd|amazon). (See Wikipedia for a discussion.)
Don't try to get clever, just use random passwords.
Thank you so much! It is exactly what I was looking for.