8 ms·

Not to mention this gem: > it is fine to write down your passphrases and keep them in a safe place

gozo 11y ago
I don't see any problem with that. Physical security is much easier to manage than digital security.
OJFord 11y ago
The age-old "don't write your password down!" mantra is not meaningful without clarification. That is essentially, of course, how password managers work! There's no reason not to write a password down as long as it's securely stored. You probably need embarrassingly little physical security to store your password more safely than many dodgy website solutions! I _still_ frequently get my _already set_ password emailed to me in plaintext either on sign-up, or when I click "forgotten". (The site is always treated to an angry email encouraging a thorough redesign - though not of course, a 'reply', which would give them even easier access to my password!)
jlgaddis 11y ago
You left out the beginning and ending of that sentence: > "Unless you have concerns about physical security, it is fine to write down your passphrases and keep them in a safe place away from your work desk."
anoother 11y ago
Good enough for Bruce Schneier: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...
SmellyGeekBoy 11y ago
Why not? Write them all on a piece of paper and lock it in a safe. Probably much safer than a password manager.
- Tenhundfeld 11y ago
  Absolutely. I use a password manager for everything except a handful of ultra-critical sites, mostly things involving money or attack vectors to get access to my email. For those sites I don't trust to store in LastPass, I write the passwords down on paper. But I also do something I haven't seen others recommend: Have a (logical) salt for all of the passwords. Don't write down that salt. So, if you found my piece of paper with passwords, you might see something like this: Etrade - I1999IbmfsaaymIwIbmoi Gmail - D9cjeawfocsIdkwhtfts4r But my actual passwords are something like this: Etrade - I1999ibmfsaaymIwibmoi804WMainStreet Gmail - D9cjeawfocsIdkwhtfts4r804WMainStreet 804WMainStreet is tacked on to the end of all of them, but you wouldn't know that from looking at the sheet of paper. Only my spouse knows the salt, and it's easy for us to remember, e.g., maybe 804WMainStreet is the address of the first place we lived together. In theory, this is reducing randomness, which might make it easier to crack one knowing the others, but I'm not super concerned about that. The two most important elements of security for regular consumers are: 1) Use different passwords for everything. 2) Use multi-factor auth when available. Whatever you have to do to achieve that is better than not doing it. *And I actually use initialism for these passwords so I don't have to pull out the piece of paper often, only when I forget. In this example, the Etrade password might be derived from "In 1999 I bought my first stock as a young man. I wish I bought more of it."
  - yellowapple 11y ago
    > *And I actually use initialism for these passwords so I don't have to pull out the piece of paper often, only when I forget. In this example, the Etrade password might be derived from "In 1999 I bought my first stock as a young man. I wish I bought more of it." Ideally, you'd just set "In 1999 I bought my first stock as a young man. I wish I bought more of it." as your actual password :)
    - Tenhundfeld 11y ago
      Can't really argue with that. I guess got this in habit of using initialisms, because a lot of sites had limits of 32 characters for passwords. But that's probably less true these days. Since they should be hashing the password anyway, why not allow something huge, say up to 1000 characters.

gozo 11y ago

I don't see any problem with that. Physical security is much easier to manage than digital security.

The age-old "don't write your password down!" mantra is not meaningful without clarification. That is essentially, of course, how password managers work! There's no reason not to write a password down as long as it's securely stored. You probably need embarrassingly little physical security to store your password more safely than many dodgy website solutions! I _still_ frequently get my _already set_ password emailed to me in plaintext either on sign-up, or when I click "forgotten". (The site is always treated to an angry email encouraging a thorough redesign - though not of course, a 'reply', which would give them even easier access to my password!)

jlgaddis 11y ago

You left out the beginning and ending of that sentence: > "Unless you have concerns about physical security, it is fine to write down your passphrases and keep them in a safe place away from your work desk."

anoother 11y ago

Good enough for Bruce Schneier: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...

SmellyGeekBoy 11y ago

Why not? Write them all on a piece of paper and lock it in a safe. Probably much safer than a password manager.

Tenhundfeld 11y ago
Absolutely. I use a password manager for everything except a handful of ultra-critical sites, mostly things involving money or attack vectors to get access to my email. For those sites I don't trust to store in LastPass, I write the passwords down on paper. But I also do something I haven't seen others recommend: Have a (logical) salt for all of the passwords. Don't write down that salt. So, if you found my piece of paper with passwords, you might see something like this: Etrade - I1999IbmfsaaymIwIbmoi Gmail - D9cjeawfocsIdkwhtfts4r But my actual passwords are something like this: Etrade - I1999ibmfsaaymIwibmoi804WMainStreet Gmail - D9cjeawfocsIdkwhtfts4r804WMainStreet 804WMainStreet is tacked on to the end of all of them, but you wouldn't know that from looking at the sheet of paper. Only my spouse knows the salt, and it's easy for us to remember, e.g., maybe 804WMainStreet is the address of the first place we lived together. In theory, this is reducing randomness, which might make it easier to crack one knowing the others, but I'm not super concerned about that. The two most important elements of security for regular consumers are: 1) Use different passwords for everything. 2) Use multi-factor auth when available. Whatever you have to do to achieve that is better than not doing it. *And I actually use initialism for these passwords so I don't have to pull out the piece of paper often, only when I forget. In this example, the Etrade password might be derived from "In 1999 I bought my first stock as a young man. I wish I bought more of it."
- yellowapple 11y ago
  > *And I actually use initialism for these passwords so I don't have to pull out the piece of paper often, only when I forget. In this example, the Etrade password might be derived from "In 1999 I bought my first stock as a young man. I wish I bought more of it." Ideally, you'd just set "In 1999 I bought my first stock as a young man. I wish I bought more of it." as your actual password :)
  - Tenhundfeld 11y ago
    Can't really argue with that. I guess got this in habit of using initialisms, because a lot of sites had limits of 32 characters for passwords. But that's probably less true these days. Since they should be hashing the password anyway, why not allow something huge, say up to 1000 characters.