Disclaimer: I use a password manager, so please don’t direct your comments at me.
So I know this person that says they don’t use a password manager because they have a better system like… I’m gonna give an example:
Lets say, a person loves Star Wars, and their favorite character is Yoda. The favorite Their favorite phrase is from The Good Place “This is the Bad Place!”. And their favorite date is 1969 July 20th (first landing on moon).
So here:
Star Wars Yoda = SWYd
“This is the Bad Place!” = ThIThBaPl!
1969 July 20 —> 69 07 20
So they have this “core” password = SWydThIThBaPl!690720
Then for each website, they add the website’s first and last 2 characters of the name to the front of the password…
So, “Lemmy Forum” = leum
Add this to the beginning of the “core” password it becomes:
leumSWydThIThBaPl!690720
For Protomail Email it’s: prilSWydThIThBaPl!690720
For Amazon Shopping it’s: amngSWydThIThBaPl!690720
Get the idea?
The person says that, since the beginning of the password is unique, its “unhackable”, and that the attacker would need like 3 samples of the password to figure out their system.
Is this person’s “password system” actually secure?
KeePassXC can tell you if a password is secure (“entropy”, “health check”, they also use an online service to check for leaked/known passwords).
I doubt it can figure out whether a password system is secure. I’d be surprised if “leumSWydThIThBaPl!690720” didn’t get a decent score, though.
I can’t say with complete certainty, but 1password at least does have a flag if I use the same password for multiple accounts. I don’t know if it’d identify this or not
The examples above have 24 characters.
They report entropy between 119 and 120.
Completely random examples, A-Z, a-z, 0-9 and only the exclamation mark added, are above 120 across the board, up to 155.
If I add all other character blocks except extended ASCII, entropy goes up to roughly 135-155.
If I add in extended ASCII it ranges from 180 to 255, but this can cause trouble on some setups.
Personally I’d never consider such a short password for an online account.