Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Some good thoughts here.

Perhaps it would be better to have a more obscure suffix for Tier 1 passwords. Otherwise, if a password is compromised, a motivated attacker wouldn't have much trouble guessing your other Tier 1 passwords.

"wheatgrass makes octagrams in paypal" leads trivially to "wheatgrass makes octagrams in gmail" and "wheatgrass makes octagrams in #{bank_of_choice}".



Good point. What would you use as a suffix then?


You could transpose the word in some way. So maybe move each letter two keys to the right - 'p' becomes ']', 'a' is 'd' and so on. They you end up with ']di]dl' instead of 'paypal', which is a bit more obscure. It might not work so well if the rest of your passphrase is made up of dictionary words.

I'm a bit paranoid though - most compromises aren't targeted and if a hacker gets a list of 20,000 hashes to crack they aren't going to inspect them individually.


1. Switch your keyboard to dvorak (can be done with a key combination in all OSes)

2. Write "paypal" as you would in a querty keyboard

The result is both easy to remember and very hard to guess ;)




Consider applying for YC's Winter 2027 batch! Applications are open till November 2.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: