The answers to this question, and the associated xkcd got me wondering: if I use different account names in every service, then can I use the same hard-to-crack password in each?

I'm thinking that cross-site password hacking, a-la-xkcd, is done by a machine, not a person.   So it's easy to have usernames/emails that are site dependent (for example, all email addressed to @gregories.net comes to me, so I can have bank-account@gregories.net as the email for my bank).   That's a lot easier to remember than a bunch of secure passwords, but if the bank gets hacked, bank-account@gregories.net is not going to work anywhere else.

What's the problem with this?

Big data analysis means that your different usernames probably aren't as disassociated from one another as you think they are. In other words, they are likely all identifiable as yours.

But perhaps the bigger issue is that if your password is compromised in one attack, then it becomes part of a password database the attackers can use against other password databases. Regardless of your usernames, they'll still (potentially) compromise your other accounts just by virtue of already having your common password in their database.

More recent attack vectors use heuristic techniques more, and things like rainbow tables less, but still consider that if a heuristic approach has broken your password (and the lessons learned have been fed back into the password cracking algorithms), then it's going to break the same password everywhere you've used it.

You're still better off using unique passwords for each service, IMO.
