Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I used to do this before switching to a password manager; the problem with pattern-based passwords is that while in paper it sounds better than password reuse (unique passwords for each site/service while still being able to remember them, yay!) in practice you are still using the same pattern for all of them. A potential smart adversary could figure out the pattern used and then apply it to every site/service much like if the password was reused. E.g., if your facebook password is "j0hnf4c3b00k83", an adversary could easily guess that you are using a site/service pattern, and that your google password is "j0hng00gl383".

Of course, the pattern doesn't have to be that simple, but even if it were incredibly complex, at the end of the day you are still relying on one single pattern for all your passwords.



Right. But the idea does take advantage of the fact that some kinds of patterns are more obvious to humans and some to machines. Most people's threat model is a massive data breach rather than a determined single attacker focused on them who actually uses a smart human brain to analyze the passwords.


Exactly. If someone goes after you personally, they'd need several of your password (at least three or four) if you have a decent algorithm. Then they'd have to find that pattern.

Most password leverage comes from breaches and people running larger scale operations for scamming and spamming.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: