Ever since the Lastpass breach (thankfully moved to Bitwarden and recycled passwords prior) I've had a heightened awareness of the potential for vulnerabilities beyond my paygrade leading to online catastrophe for me. I use Bitwarden to generate a random password for all sites.
If it's something which could truly cause a headache such as my email or banking however, I'll usually append the domain name, or a word, or a symbol to the password such that after my phone or PC's Bitwarden autofill enters the saved password I also need to enter whichever word or symbol for the site. Feels like this gives me some defense if people smarter than me made a mistake, but I guess I have questions for folks who know about hashing/blackmagic/thecyber.
- Would this have any benefit, if one were to put "google" at the end of their Google password, as far as protecting from a password manager exploit?
- No, I don't actually put google or reddit at the end of my password; oops not a question
- Is that already something baddies would know to try? Or did I just play myself by posting this on the internet?
This honestly sounds like a pretty good idea. Things like ransomware attacks / the fappening / anyone who's had their online banking broken into can tell you that it's not an academic issue. Using Bitwarden so you're not using the same password for multiple places sounds like a wonderful idea (necessary tbh), and adding some stuff to it just so it's not a single point of failure sounds like a sensible additional step that might well have effects in the real world. As others have said in re just adding "google" to the end or something, you don't need to be bulletproof, but you do need to be a hard enough target that the automated / low-effort attacks that definitely will come, won't work on you.
Just remember, this is one of those things where "nothing happens" is the desired outcome. There's a temptation to tell yourself "Well I'm taking these additional steps and it didn't make a difference," but you won't really know if you ever dodge some kind of compromise that would have made a difference -- you'll just have the experience "nothing happened." But that doesn't mean it was a waste of time. Nothing is what you wanted to have happen.