Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

With the big amount of websites that require a registration or provide a benefit for registering, it is impossible to device and remember a unique password for every account we have. A possible solution is the password manager. However, is there a way to generate passwords that don't have to be remembered, but instead can easily be retrieved as needed, without the use of a separate program?

My direction of thought is the following: device a core password (with a backup for those "not more than 16 chars" situations). Use a preselected component of the website - for example, the site name, taking the core password "password", and using the letters of "yahoo" to form the yahoo password, "ypasswordo". Of course, this is not optimal, as website URLs change, especially those of less-used websites, which are incidentally exactly the ones I'm likely to eventually stop visiting and forget the passwords for.

Is there anything I can use from any website I'm registering on that I can be certain will not be changed after a while, and will be different from site to site?

EDIT: Since my question seems unclear, I'll give an example. Imagine that all websites ever created had an ID buried in their source code. It doesn't have to be unique, it just needs to be unlikely to ever change and to be present in all, or at least the vast majority. One could run a simple algorithm on that ID and add a core password to produce a password for that account, which could just as easily be obtained 10 years later just by knowing the algorithm. Is there a part of a website that is unlikely to change, isn't the same across every website out there (overlap is normal, as long as it doesn't lead to rotating 5 same passwords across all accounts)? Is there any way to create and later retrieve a password, doesn't have to depend on the website's code at all, with minimal risk of loss and without any memorization?

TL;DR: Suggest a method that, without extra memorization or program usage, can be used on any random website to produce the used password with complete certainty, or at least a list of up to 10 passwords of which one will 100% be true. The password produced shouldn't be the same across all websites and should have minimal or no risk of being lost, even years after account creation. The end result should be the ability to reproduce the password used on any long-dormant throwaway account from any computer, without dependance on installed programs or online password managers or carrying around the passwords. The passwords don't have to be crazy secure, just reasonably unique.

share|improve this question
    
Learn to do SHA in your head. It will make this a lot easier. –  Oliver Salzburg Mar 20 '12 at 18:36
    
I don't know how hashes work, but I'd either need to remember a randomizer element or all the passwords will end up the same, so no-go ;) –  Fadeway Mar 20 '12 at 18:41

3 Answers 3

up vote 3 down vote accepted

I have a password matrix that I use. I have it printed and tapped on the back of a business card. I use this matrix to generate my passwords. I have a very set algorithm that I use based on the sensitivity of the data I'm trying to protect. Only I know my algorithms. I may have something simple like SuperUser's account password be just the top row. A bank site or a site dealing with money may be the first half of column 1 and the second half of column 2. I use a 8x8 matrix so that I can meet typical minimum length passwords. On sites that require me to change my password every 2 weeks with a rolling 5-8 memorized password restriction, I'll use my matrix and then a special character from Shift 1 to Shift 0. Below is a horrible example to my matrix and completely random. I had a hard time and had to reference back to it for the first month, but after a month or two, I had the whole matrix memorized and now don't use it anymore. However, if someone ever stole my wallet, it wouldn't do them any good since they don't know my algorithm used to generate the password. In the hint sections of the websites/programs if applicable, I will put my algorithm name there; special bank, complex 1, complex 2, reverse complex, etc.

enter image description here

This website will generate a password matrix for you if you don't want the hassle of making up your own.

share|improve this answer
    
And what do you use to figure out which algorithm you've used? Say, you have the simplest form, using a row. How do you know which row you used for that website? The combinations are limited and can be exhausted with a reasonable amount of guesses if you know which method you used, but I reckon you don't resort to that every time you revisit a dormant account? And what do you do if the website doesn't have a hint section (I can't remember the last time I've seen a field like that actually, and I probably won't ever see it on a throwaway reg), to determine which algorithm was used initially? –  Fadeway Mar 20 '12 at 18:34
    
I have 10 algorithms. Based on the sensitivity of the data I am trying to protect on the website, I will use an algorithm based on that level of security. Sites that just require my first name, last name and email get a ranking of 1 which is not secure. Email accounts are an automatic 5. Bank websites are a 10. World of Warcraft account is a 8. Facebook account is a 9. –  kobaltz Mar 20 '12 at 18:40
    
I think I'll use this if nothing else appears. It's a system that helps remember dozens of passwords with minimal effort and also estimate which of them are most likely to have been used, so slightly flawed (a lot of retries on old accounts, but 100% certainty to find it eventually), but much better than my currently rotating 10 memorized passwords :) –  Fadeway Mar 20 '12 at 18:44
    
It's definitely not for everyone, but it works for me. –  kobaltz Mar 20 '12 at 18:50

I understand your question because I add a prefix to my email address to track down spam, e.g. I sign in to Amazon with handle+amazon@gmail.com where handle is my email username. Your question goes somewhat in the same direction.

If you want to go forward with your idea, use a reasonably strong master password like F_D_W_Y#00 and simply add the name of the service in simplified form to it as a prefix. That requires memorizing the simplified forms, like -yahoo or -google. I believe this system will fail you only at very high usage.

However, if I were you, I would rather use something like 1Password to stay on top of the password game. It generates random passwords with much better strength than what you will get from remixing website information (except if you remix alphanumeric information with diacritical information, in which case your Yahoo! password would rather look like y!pwd#2012, for instance).

Your project sounds riskier than using a master password and a password database. Browsers like Google Chrome has deficiencies in their password storage systems that will also justify using a separate database that can be safely backed up. And of course, any memory system is fallible too.

share|improve this answer
    
The goal is to avoid pass managers, as stated in the question. It is a system that should be usable with every, or most, websites. Using the service name is not an option, as I personally use at least one comparatively major (1 mil users) website that has changed its name in the past 5 years, something which is significantly easier to do with a smaller community. Password complexity can introduce problems (Do they support symbols?), and as xkcd tells us, length trumps being unreadable. Really important accounts that may be attacked non-bruteforce are rare enough to be remembered separately. –  Fadeway Mar 20 '12 at 18:22
    
How many of your services changed names in five years? If it's only a handful, then change your password when you notice the change in name. It's good practice to ventilate your passwords however strong they are. As for length, you cannot reach high password strength below a certain threshold. Note that it takes only a few seconds to type capitals and underscores on a QWERTY keyboard. –  Fr. Mar 20 '12 at 18:45
    
5-8 years ago, I tried out more than a hundred (literally) online games. This left me with a lot of throwaway accounts that I am no longer aware of. If one of those games changed name, or if the reg was publisher-bound and the game changed publisher, I'd never learn nor care about that. I will invariably lose the account though. I probably won't embark on such a game spree again, but with every website around demanding a registration, accounts are inevitably created and forgotten, sometimes within a single week. It's not feasible to maintain those accounts. –  Fadeway Mar 20 '12 at 18:53
    
Alright, now I get your problem. You are not dealing with more than the usual number of services. I don't see how you will manage having more than memory involved if you want a secure system. A plain text list of names and URLs would suffice. –  Fr. Mar 20 '12 at 19:10
    
It doesn't have to be crazy secure, most attacks are plain bruteforce or dictionary check, against which using unique and long passwords grants immunity. For the few really important services the password can be remembered, although rare is the attack with any amount of thoroughness focused on a single account, even on those. Carrying around a list of passwords is unpractical, especially for every account ever made. –  Fadeway Mar 20 '12 at 19:42

I use a base password and part of site I am logging into. For example:

Website: amazon.com Base password: Turtle992%^ Password for Amazon: AmaTurtle992%^

This method keeps the password for each site unique and is easy to remember. No software required.

Some issues with this method are that if someone knows the base password, then the password for lots of sites will be revealed (in the same was as if you used the same password for everything.) And some websites still do not allow punctuation or special characters as part of the password (banks, I'm looking at you) so you have to remember which sites don't allow punctuation.

share|improve this answer
    
Having seen your other comments, it looks like this won't be a very good choice since part of the password is based on the url. –  Melikoth Mar 20 '12 at 18:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.