Self 'salting' your same password across different sites

[d000hg]

I had this idea a while back as a way to let you use the same password on different sites without compromising security.

My thought was to 'salt' your same password, based on the name of the website. e.g. instead of just using 'password' I'd use 'passwordcontractoruk' on CUK, 'passwordgoogle' for google, 'passwordnpower', etc, etc.

It's very easy to remember and would be proof against automated attacks which get your plaintext password for one site and try on others. Also it makes breaking your password hash harder since the hashed string is less common.

Of course a human inspecting your password could guess what's going on but in my mind, that's not how these things work. Or is it? Could anyone who knows about this stuff comment on the idea - is there a glaring problem I missed or a bad assumption?

[BrilloPad]

I have forwarded your post onto the central Russian crackers society. They said you will be safe to use it this week - but by next week they will have closed the loophole.

[Ketchup]

I use something similar. As i am a member of numerous forums and messageboards, remembering numerous passwords can be a nightmare, so i add a 3 letter salt to the password indicating the site, e.g. this one is cuk.

I do not use it for anything that can be used to steal my identity (facebook, twitter, email, banking etc).

[DaveB]

I had this idea a while back as a way to let you use the same password on different sites without compromising security.

My thought was to 'salt' your same password, based on the name of the website. e.g. instead of just using 'password' I'd use 'passwordcontractoruk' on CUK, 'passwordgoogle' for google, 'passwordnpower', etc, etc.

It's very easy to remember and would be proof against automated attacks which get your plaintext password for one site and try on others. Also it makes breaking your password hash harder since the hashed string is less common.

Of course a human inspecting your password could guess what's going on but in my mind, that's not how these things work. Or is it? Could anyone who knows about this stuff comment on the idea - is there a glaring problem I missed or a bad assumption?

It's an approach thats been around for a long time, and yes in principle it is a good idea. However the bad guys take this into account and will use common patterns to modify rainbow tables and other brute force source files to include common website names and variations. "mypasswordcuk" is probably safe as it's pretty low profile in the scheme things and unlikely to figure on the list of varations to be tried, "mypasswordebay" or "mypasswordpaypal" is probably less so. Unique, strong passwords that dont share a format are still the safest for the sites you really care about.

[kingcook]

I use a different username and password for all websites.

Username generated with the likes of Username Generator - Random Username Generator

Password generated with a small program I wrote myself, although there are password generator websites out there. Password is a load of random crap including punctuation symbols.

[Gentile]

I had this idea a while back as a way to let you use the same password on different sites without compromising security.

My thought was to 'salt' your same password, based on the name of the website. e.g. instead of just using 'password' I'd use 'passwordcontractoruk' on CUK, 'passwordgoogle' for google, 'passwordnpower', etc, etc.

It's very easy to remember and would be proof against automated attacks which get your plaintext password for one site and try on others. Also it makes breaking your password hash harder since the hashed string is less common.

Of course a human inspecting your password could guess what's going on but in my mind, that's not how these things work. Or is it? Could anyone who knows about this stuff comment on the idea - is there a glaring problem I missed or a bad assumption?

Unfortunately it's a commonly-known practice. It's as predictable as the way most people capitalise the first letter of their password and add an increasing integer suffix each month (e.g., "Password1", "Password2") when they're forced to set a 'new' password with an enforced 'complexity policy' by corporate IT network administrators.

Similarly, people think they're being clever when they '5ub5t1tute' predictable letters for numbers in passwords. In reality, it's such a common tactic that most penetration testers have rainbow tables already pre-calculated with those sorts of substitutions built in, so if they get a hold of your hash it's easy to crack single words obfuscated in that way.

And finally, it's amazing how many websites out there still aren't using best practice, and are storing the plaintext of a password rather than its hash/cyphertext. It only takes one of those sites to be compromised or to have dishonest or disgruntled staff, and if you've been predictable about how you've set passwords across sites that can reveal how to access more sensitive sites that you care more about, such as your bank or e-mail.

One of the best ways to safeguard each site is to condense them into a short, easily-memorable, relevant-to-site phrase. E.g., for the Tesco site above you might have "WhereIGetMyShopping". If you want to add extra security against brute force attacks using the likes of rainbow tables, you could also add a non-alphanumeric character after the second or third word (so it appears in an unpredictable place in the string, but a place that is easily- memorable to you). You can do that by holding down 'Alt' and typing a four-digit number (maybe a memorable date such as '1066', or just something that makes an easily-memorable pattern on the numeric keypad), then letting go of Alt. That'll insert some rarely-used Greek or Symbol character, making brute-force attacks all but impossible. The key thing, though, is that using those methods gives little away about the passwords you use on other sites ("MyGodಠಠTheirWebDesignIsAwful" for JobServe, and "BunchOf■RobbingBastards" for your bank).

[d000hg]

Those things you suggest are fairly simple, but I'd always figured these automated systems relied on the fact people don't do this and pick the easiest fruit. After all it probably multiples by a significant factor how many different hashes you'd need in your table.

Have you got any links to back up the claim the nasty people do this kind of stuff as standard? No doubt as/if people get better at passwords, they would start having to to get good results

[Incognito]

Have you got any links to back up the claim the nasty people do this kind of stuff as standard? No doubt as/if people get better at passwords, they would start having to to get good results

Pedantic mode - what you're suggesting isn't technically 'salting'.

I would recommend taking a look at the following blog entries:

You expect me to remember that? Part 1
Profiling your hashlist, and targeting with mask attack.

Chap has built a machine, Project Erebus, that is capable of cracking the whole key space for any upper, lower, special, or digit password at length 8 for NTLM within 12 hours. Details are on the website above. It only cost around $12K - so it doesn't cost much to crack passwords these days.

[Mose]

Definitely wrap your modem in tinfoil, and take the phone jack out when not in the house.

[Sysman]

Chap has built a machine, Project Erebus, that is capable of cracking the whole key space for any upper, lower, special, or digit password at length 8 for NTLM within 12 hours. Details are on the website above. It only cost around $12K - so it doesn't cost much to crack passwords these days.

And far cheaper than $12K. How I cracked my neighbor's WiFi password without breaking a sweat

Using the Silica wireless hacking tool sold by penetration-testing software provider Immunity for $2,500 a year, I had no trouble capturing a handshake established between a Netgear WGR617 wireless router and my MacBook Pro

then uploaded the pcap files to CloudCracker, a software-as-a-service website that charges $17 to check a WiFi password against about 604 million possible words. Within seconds both "secretpassword" and "tobeornottobe" were cracked. A special WPA mode built-in to the freely available oclHashcat Plus password cracker retrieved the passcodes with similar ease.

So I got the permission of one of my office neighbors to crack his WiFi password. To his chagrin, it took CloudCracker just 89 minutes to crack the 10-character, all-numerical password he used, although because the passcode wasn't contained in the entry-level, 604 million-word list, I relied on a premium, 1.2 billion-word dictionary that costs $34 to use.