For example, change your password regularly, use 2FA.

  • thelastknowngod
    link
    fedilink
    English
    arrow-up
    18
    ·
    1 year ago

    I pepper my randomly generated passwords. For example, imagine you have a random string generated from your password manager. If the password manager’s database is breached or your master password is leaked somehow, the attackers have access to all of your information.

    Now think of a word or acronym or something… Something simple (can be simpler than a normal password). When you add a login, save the generated string to the manager but use a combination of the string + unique word for the website login.

    Let’s assume CHEESE is my pepper word.

    The generated string: hjifd;39Vq$7}

    Saved to password manager: hjifd;39Vq$7}

    Submitted to website: CHEESEhjifd;39Vq$7}

    Now even if the database is leaked my passwords are still mostly useless.

    • HaphazardFinesse@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      I do something similar (though less secure) for general purpose passwords; I have a couple of common “base” passwords that are decently secure that I commit to memory. Then for each website/service, I pick a pattern based on the name/url (maybe something like the first two and last three characters of the url), and append them to one of my “base” passwords, so each site gets a unique password, but I only have to remember a couple of them + the pattern