As long as it’s capitalized with a 1! at the end

https://m.youtube.com/watch?v=z_HmDP3lKMI

KeePassXC can tell you if a password is secure (“entropy”, “health check”, they also use an online service to check for leaked/known passwords).

There’s literally only 4 characters difference between all their passwords, even if those would be completely random, that’s very bad.

They don’t seem to understand that it’s not about how many samples you need to see to be sure what their Amazon password is. The problem is that if one of their passwords ever leaks, some bot can brute-force try thousands of variations on it and find any other password very quickly (they effectively only have to guess 4 characters, plus a bit to find that it’s the first 4 to change).

How can anyone think this is more secure than having completely different and long passwords for every site?

They probably don’t understand that your pw manager’s password is safer because you don’t enter it anywhere, only into your password manager (ideally with 2FA). This person is effectively spreading their master password around by putting it as the core of ALL their passwords, significantly increasing the risk that it leaks.

I get the idea as I used to do this too. Having secure & different passwords everywhere is just the basic way to go. As such I dont think though its a good idea to put a system in your passwords. Hacking attempts are automated and getting smarter every day. Its only a matter of time until someone unleashes an AI to look for patterns and you are toast.

I recommend to juse a decent password manager that generates them for you and as much MFA as possible.

On one hand, it’s probably not that unlikely that an attacker gets 3 samples if the email or username gets reused a lot, on the other hand I wonder how well automated password crackers deal with systems like this. ‘one good pattern with a couple of extra characters per site’ seems like a pretty common password system.

If this person is scared to have password stored, you can talk them about lesspass. It is available as a website where everything happens inside the browser, a browser plugin or an android app and it uses crypto derivation to generate unique passwords for each site.

A phrase is better:

unlucky friendly monkey got raped by feral donkeys the monkey ran away from donkeys led astray

It’s not very different from a sequence of 13 symbols, but there are many more words in English lexicon than symbols in ASCII plus 10, and the password becomes easier to memorize.

This is also an adaptation of a joke from a Russian cyberpunk novel, one of the last good things by its author, called “Labyrinth of reflections”. It’s still very good BTW.

One my friend has a very good taste in books and poetry, but when you talk to him, you wouldn’t think that. He spews bullshit about “patriotism”, alternative history, “anti-male laws” and such, believes that he can feel energies, and the only way to notice there’s something much better buried underneath is to talk about random life events for long, not trying to fix on anything in particular or reason logically. Yet every book he’s advised has been precious to me.

This system is fine. While patterns are obviously easier to hack, having unique passwords for each site and being able to remember them puts your friend in the 90^th percentile of computer users.

I reject the premise!

There is no safe or unsafe. It’s more like “more safe for a given person”.

Your friend’s system is better than using the same password everywhere. It’s more difficult to hack than the majority of passwords that aren’t generated by password managers. If that’s what your friend likes and works for them well, fine I guess.

It wouldn’t work for me because:

• it doesn’t input the password for you. Does your friend really type passwords in all the time?
• IDK if my memory is particularly bad but having to remember anything at all is hit and miss. Like I could remember those characters that are used everywhere, but for the router at my mum and dads house that I haven’t accessed in 5 years, was it “mums router” or “router mums house”
• Also I manage multiple passwords for the same sites, as in credentials for my partner or whatever, but I guess I could make variant of this system.
• also if I were to die the person who sorts out all my stuff will have access to my passwords
• but the main reason is… I use my keepassxc db as a database for all sorts of things which aren’t necessarily passwords. ssh keys are a good example. I use it for TOTP. bank card details. membership numbers and government ids. VIN numbers for vehicles. Also, a weird one, I have to keep track of about 100 physical keys for reasons, I stamp a number on them like k32 and then store that number and an explanation of what it’s for in my db.

I hope you didn’t make their actual basic phrase public.

In my opinion any password that’s designed to be human-friendly isn’t secure. Every crutch one uses to remember it, a machine can make much faster use of.

In this case I’d say the core idea: “SWydThIThBaPl!” is relatively safe, but 690720 is almost immediately recognizable as a date - to a machine! - and amng, leum etc. are even easier assuming the cracking program has knowledge of which site they’re trying to gain access to.

So the only good part is the one that repeats for every password.

I think the top half of this xkcd illustrates some of it; but iirc the bottom half has been sort-of half debunked.

In any case, I use only very long and completely random passwords for online accounts.

Does this person think password managers are crutches? You cannot out-remember a machine.

Its secure enough for the average person. If your friend was a big deal, super rich or powerful and a massive target it would be easy enough to figure out.

I doubt it would be worthwhile trying to crack that particular code for the average joe.

So, dedicated enough to embrace the importance of a solid password but not humble enough to think he’s got a better system than what everybody else reccomend.

The system is clearly flawed ego wise.

It’s an insafe password + salt.

There are two answers to your question.
Most password cracking operations target a database of user accounts in bulk. As long as the hacker is not targeting your friend specifically, they should be fine.
If your friend is the target, one or two successful hacks could make their other passwords vulnerable.

So no this is not safe. Once ypu have a system it is easier to crack because if someone has 2 or more of your passwords they can work out there is a system and it’d make it much easier to crack others if they’re determined.

It is unlikely that someone random would specifically target a person and systematically try and crack their passwords. If that were to happen it’d most likely he someone they know - and this does happen sometimes. So while the passwords are definitely flawed it may not be something that anyone takes the time to exploit. But you can never say never.

The best way to manage passwords probably remains a secure password manager and randomly generated series of characters for each site. If its truly random then there are no shortcuts and every single password stands independently. The password manager gets round the issue of memorising them.

That system is vulnerable to social engineering attacks. If hackers found out all their favourite things that lead to the core part of the password, guessing the prefix wouldn’t be that hard. Also, what would your friend do if one of these passwords got compromised and had to change it? Would he just add a 1 to the site-specific part of the password?