I am not suggesting using a password that isn't a reasonably secure password.

I occasionally get those warnings from identity monitoring companies saying a password associated with my primary email as the username has been compromised but they often do not tell me the website. I suspect many are from old website forums where I regularly used the same old password associated with low risk sites.

I was thinking something like the following as a new password format: xA#f14$987golfwebsite

That way I know who had the security breach.

Anyone think that's a bad idea?

I try to keep higher risk login credentials completely unique these days.

quote:

Originally posted by Oz_Shadow:
I try to keep higher risk login credentials completely unique these days.

Does that mean you have the same password for "low risk" sites?

Whatever your method, make it a difficult one. And uniquely difficult for different sites.

^^^^^
Re: “Whatever your method, make it a difficult one. And uniquely difficult for different sites.”

Amen. Thank goodness for password managers.

I use movie quotes. Usually no less than 40 characters. Replace i’s with 1’s or a’s with 4’s and use all correct punctuation and spaces.
As of now, I have never had an issue.

Think of 5 unrelated 5 letter words, use that, its mathematically secure enough.

that method works for email addresses like using ReyHRH+Sigforum@gmail.com. If you start getting spam emails, you know it was taken from Sigforum. But how would it work for passwords? It won't let you know the password that was hacked.

For non-internet passwords, I use something like Bender's formula: Five-words-that-I-always-remember+name of the thing I'm protecting+last word I also remember.

A properly-configured login capability should never ever store a secret "in the clear." Instead, the password is stored in an encrypted or hashed form. When the user enters a challenge, the challenge is encrypted/hashed with the same algorithm before comparison with the stored value. (There is, of course, somewhat more to it than that.)

So anybody presenting "your password" to you must have obtained it from an improperly-provisioned site. Encrypted storage of login secrets has been a best practice since at least the 50's, long before the Internet was built out, or the first web server authored.

It is far more likely that the password was obtained by a "man in the middle" attack, a keystroke logger, or some other interception technique (perhaps via software surreptitiously installed on the compromised provider's system) rather than decoded from some password data store. So associating a compromised password with a particular site does not necessarily implicate that site in the breach (except that they might be negligent in their security policies and/or procedures), and is unlikely to positively determine some entity to "blame."