Cybersecurity

I have responsibility. They require us to change our passwords every 3 months.

I mean, do your best, but honestly temper your understanding of your responsibility here.

You may feel responsible, but your employer DOES NOT.

How do I know? Because it's been the NIST guidelines for like a fucking decade already NOT to use such policies because they are EMPIRICALLY PROVEN to REDUCE security and INCREASE the likelihood of a system compromise.

The fact that you're here trying to "solve" a "problem" that was artificially generated by your employer is exactly the reason it's the case. While you personally are diligently considering how to best "solve" it, everyone else is doing something more hack-y and introducing new attack vectors.

So... Long story short, it's awesome you care. Your employer does not.

I say go for it.

If you're working on something sensitive enough that a Yubikey isn't good enough security, then the team you're working with should be enforcing other protections like MFA, which mitigate the algorithm risks.

Obliviously, if you get a chain fraudulent MFA requests, change your password approach, though.

Otherwise, it beats what most people are doing by a long way. Casual attacks are going to go through Karen in accountings weak password, not reverse engineering your Yubikey.

Edit: Your prefix length matters here, though. You don't want it to be so short that it volunteers for more scrutiny in a breached data set.

Edit 2: Marcos makes a great point about putting yourself in a position where, when you change your password, it's necessarily extremely similar to previous passwords. That's not great.

Algorithms like that never really work because password requirements are quite varied, especially stupid stuff like maximum lengths.

My understanding is that it's debated whether password algorithms are a good idea, but personally, I wouldn't use them because if someone figures out one password, they can figure out the rest. Why not just use a new KeePass database on your work computer? If you don't want to memorize a string of random characters for the master password, why not use a passphrase of random space-separated words?

Yubikey is proprietary and not updateable. If there is a security flaw, you literally need to buy a new one to be sure.

Yes, but telling you how I do it would be bad opsec.

Why not get a separate password manager for work stuff and use the Yubikey to login to that? That way you get a unique password for each site and don't need to remember a long password for the password manager. So one password slot for work and one for personal password manager, and the rest comes from the password manager.

The main risk is if your password gets compromised, someone could figure out your "algorithm" and get access to the rest. Whether that's likely depends on what you use those passwords for.

Using a prefix with a 40 char password is not really a good option because if this was compromised because it was let’s say intercepted then the attackers would easily be able to guess that if there is bank_suffix then facebook_suffix might be a good guess.

Look into OnlyKey. Its a hardware password vault with a lot of nice features. USB only, though

The "base password" concept isn't completely crazy, I've got a friend who claims to have a system like this, to keep all his passwords in memory.

The key, though, is that the modification to the base is NOT just "usbank" or "facebook" or whatever. If your system for modifying the base is too simple, then if one of the sites you do this for is breached, and its passwords exposed, you can bet that attackers that get ahold of those are smart enough to search for "usbank" and "facebook" and other variations, to figure out what your base password is, and take that and apply it on as many other sites as they can, and may well breach your other accounts.