39
[Question] Is this a secure way to generate passwords
(sh.itjust.works)
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
Community Rules
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
My understanding is that it's debated whether password algorithms are a good idea, but personally, I wouldn't use them because if someone figures out one password, they can figure out the rest. Why not just use a new KeePass database on your work computer? If you don't want to memorize a string of random characters for the master password, why not use a passphrase of random space-separated words?
This. And "figuring out one password" can mean stealing it from some 3rd party server with bad security practices. The password complexity and the other OP's practices aren't relevant.
You also can't change passwords easily, what again is a problem on those sites that have bad security practices.
It's possible to make an algorithmic derived password that doesn't have that first flaw (losing one doesn't lead to losing all), but the second one will always be around.
I may not have been clear in my original post. My work computer does have it's own KeePass database. This question is for my use of a Yubikey on multiple sites. For clarification I use a separate Yubikey to store my work computer credentials that I back up to my personal Keepass database (can't access the work database if I'm locked out). I do this because of the requirement to change passwords every three months and I don't want to reuse the limited passwords I remember so I use a password generator.
My question is with using a "prefix" with my personal Yubikey (the one I don't use for work). Specifically, even if the last 40 characters is from a generator configured to generate a high entropy excellent quality password if I use that password with a different "prefix" (different lengths too) for different sites then would it really be compromised if one site gets hacked? They are different passwords, different hashes, different entropy. It's just a large part is the same. I don't know much about security I just want to know if this is a risk. I'm trying to move my security from something that I memorize to something that I physically have and know.
Why not use the Yubikey for the master password on a KeePass DB (or another password manager) and then use actual different passwords—not just prefixed ones—saved in said password manager for your logins?
It doesn't matter if your base password is a 255 character high-entropy annoying-to-type-manually-on-a-phone-keyboard or a 16 character string of alphanumeric characters if you reuse it in a slightly predictable manner. For it to be somewhat secure, the prefix would have to be completely random, which kinda defeats the idea of you being able to remember them. A "base password" is, to be frank, only one small step up from using the same password everywhere.
And as someone else pointed out, it makes it very difficult to change passwords, which also should be a huge red flag.
Take a look at the leaks on Have I Been Pwned and see how many of them include either clear text passwords or extremely weakly hashed (perhaps even unsalted) passwords. If you show up in just one or two of those, then you're in a significantly worse position than you would be had you just used different passwords.