What type of function can be secure & easy password on webSite?

Question

Sorry in advance for my poor English & this question might be off-topic.

I would like to know the best function for countermeasure of password cracking.

Setting each Password in each web service is not easy way. Same Password in each web service is not safe way.

So I wonder just memorizing the function and calculating password each time in each site is good way.

Specifically, we will deal with this method like this.

1. Input value are a name of web service & count of its name.For Unity, we adopt the name from domain.

   Example web service: https://google.com

   Input value x: google (String Type)
   Input value y: 6 (count Number of domain name,Number Type)
   

or x should change some yourmasterword+domainname,as mr.orion suggested.

2. function is something like this.(this is just a example)

$$ f(x,y)= (x−２)/2 +4y$$

3. The rule of four arithmetic operations of x(string value) is as follows.

   addition:(x+x) →　googlegoogle (x+y)→google6 (x+2)→　emmejc
   subtraction:(x-x)→none or 0 (x-y)→6google (x-2)→iqqing
   multiplication:(x × x)→googlegoogle (x × y)→google6 (x × 2)→　google2
   division:(x÷x)→1 (x÷y)→1 (x÷2)→goog
   
   ✴︎Addition or Subtraction of stringType with number is to aim for 　distributing of letter.This action proceed to the front(add) and back(sub) in alphabetical order.

4.So you just remember the function and when you go to website you calculate.

$$ f(x,y)= (x−２)/2 +4y$$ [google → (iqqing)/2 +24= iggi24]
[Apple →　(ynnng)/2 + 20 = ynn20]
[Netflix → (lgrdjgv)/2+28 = lgrdj28]

Infact ,these webSite require 8~20 characters. So function must contain String-type multiplication.

Again I want to know the function type that easy to calculate, easy to memory, return high-entropy values. Is that algebraic equation?

(I know the existence of password management soft.But I think increasing options is good.)

Answer 1

It sounds like you're just looking for hashing algorithms, like MD5. For example, the MD5 of google is C822C1B63853ED273B89687AC505F9FA. You can try it here.

Answer 2

There are basically two types of security. In one, the algorithm is known, and the security comes from how difficult it is to invert the function (guess the key, undo encryption, etc). This is how all computerized security works (public-private key security, symmetric key encryption, hashing algorithms for storing passwords) because the algorithm has to be known by all parties involved in order to communicate. Protection is provided by computational difficulty.

The other way is that the algorithm is secret. This can be used in communication between pre-arranged groups of people. In that case, it's quite more difficult to figure out, and harder to reverse-engineer.

What you want here is a way to generate a password for yourself! There are two points of weakness. First is that nobody should know you are using this way of inventing passwords. Second is, that the produced password (no matter how you got it) has to be hard to guess (strong password). So google2 is a bad password, no matter if you got it from your algorithm or just made it up. It can be cracked by a dictionary attack or even just guessing (only 7 digits).

Don't make your algorithm too complicated... use "salt". When passwords are stored properly, your password is combined with a random "salt" string before it is put into a hashing function. You should do the same. The function can then be very simple or even trivial. Invent a "master" password that is long and easy to remember. Then just add suffixes/prefixes/modifications. This way, as long as your master password is strong and noone know it, you are safe.

For example, my main password can be "b1ueH0RSE955!" and then on google, I can use "b1ueH0RSE955!_google", where I can make it more secure by appending something that is calculated from all of it (hash-like process, for example, just "adding" all the numbers and letter positions together modulo 26 and converting it back to a letter, possibly ignoring other characters).

The main point is: output password has to be secure, and input password has to be secret. Then, even if you tell people how you "compute" a password (which is still not a good idea, by the way), they have to guess the main part of the password, otherwise they know nothing. Making your algorithm unnecessarily complicated doesn't help, and might make things worse (false sense of security). The entropy is generated by a sufficiently good salt string / master password, and if that is strong and well protected, the rest doesn't matter much.