So I've been trying to create more secured passwords now that I have employment where I have responsibility. They require us to change our passwords every 3 months. I used to use the same passwords for multiple sites. Then I used a password manager and got rid of those memory passwords. With this job I don't want to mix my personal password manager with my work computer and I also don't want to remember a complicated 15 character long password to log in every day.
That brings me to my question. I've been using Yubikeys for years. I store a challenge response, use it for 2FA on all sites that allow, and I use it for TOTP on most sites (there's a limit to how many entries in the Yubikey 5). You can also store a password in one of it's two slots. My thinking is this: Is it secure to store a base password that is long and complicated, say 40 characters long with all the characters, and use a different "prefix" for each application? Example: On my banking site I type in "bank" then press the Yubikey to type the rest. Same thing with social media and other accounts. Each one has a prefix and I don't know the actual password. Of course I store all passwords, including the Yubikey, in a password manager that's backed up in the cloud (I use KeePassXC).
Your thoughts? Is this secure or stupid?
The "base password" concept isn't completely crazy, I've got a friend who claims to have a system like this, to keep all his passwords in memory.
The key, though, is that the modification to the base is NOT just "usbank" or "facebook" or whatever. If your system for modifying the base is too simple, then if one of the sites you do this for is breached, and its passwords exposed, you can bet that attackers that get ahold of those are smart enough to search for "usbank" and "facebook" and other variations, to figure out what your base password is, and take that and apply it on as many other sites as they can, and may well breach your other accounts.