4 ms·

I seem to recall Bruce Schneier advocating the same strategy: > I write my passwords down. There’s this rampant myth that you shouldn’t write your passwords d

by korethr 10y ago

I seem to recall Bruce Schneier advocating the same strategy: > I write my passwords down. There’s this rampant myth that you shouldn’t write your passwords down. My advice is exactly the opposite. We already know how to secure small bits of paper. Write your passwords down on a small bit of paper, and put it with all of your other valuable small bits of paper: in your wallet. [1] I think this is a viable strategy. And I don't think the fact that a wallet can be lost or stolen should dissuade a person. If your wallet is stolen, you're already facing a security compromise, with or without written passwords inside. Your typical wallet is going to contain ID cards, bank and credit cards, etc. You already need to cancel those cards and get new ones issued. Fortunately, by being in the wallet, those passwords will be rather secure. IME, people seem to understand losing one's wallet is Serious Business. The common advice against writing passwords down is not the only bit of perverse security policy I've encountered. On the AIX boxes at one my employers, it wasn't so bad that password policy required a minimum length of multiples of letters, numbers, and symbols and forbade reusing the past N passwords. No, what was BS was that the policy also forbade X repeated letters, and Y letters that were in any of the Z previously used passwords. Now, while this might have been intended to prevent users from using passwords like "aabbccdd1", "aabbccdd2", "aaaabbbb3", etc, it also in effect forbade stronger passphrases. The longer a passphrase is, the more likely you are to have multiple repeated letters, or letters that occurred in the last few passphrases. There are only 5 vowels in the roman alphabet, and many words use more than one. For example "correcthorsebatterystaple", has 6 repeated letters, and its replacement of "wargnomefinaltreetruce" not only has 4 repeated letters, but 5 letters used in the previous passhrase, thus forcing a much weaker password like "FuckA1X!". Oops. 1. http://freakonomics.com/2007/12/04/bruce-schneier-blazes-through-your-questions/ http://freakonomics.com/2007/12/04/bruce-schneier-blazes-thr...

IncRnd 10y ago
You are, of course, correct. The main issue isn't with writing them down but with people finding them if they are written down. This means not putting passwords on a post-it on the monitor and to guard them like you guard your wallet or house "keys", wherever they are written down or otherwise recorded. Of course, with so many passwords in one place, it's best to do a little planning in case a paper gets lost or wet. It's also a good idea to consider what might happen if ALL passwords get disclosed at once.
- midgetjones 10y ago
  If they just steal your computer, they'll most likely still be logged in to many services already. If there's no password at login, they can already request a password change and a confirmation email from any other site. Not to mention autofill - my Dad is a terror for this. He sees it as a convenience, but I'm pretty sure his autofill could file his tax return for him by now.
  - IncRnd 10y ago
    This is what disk encryption targets.
- taserian 10y ago
  One way of semi-resolving the issue of the paper falling into another's hands is writing the password and adding characters to it on paper that you know not to add when using it as a password. For example, when we visit my mother-in-law, she likes to hand over her ATM card for us to do local errands. My wife, knowing that she'll forget the PIN, writes it as a telephone number, where she knows the offset/method to extract the PIN.

by korethr 10y ago

IncRnd 10y ago

You are, of course, correct. The main issue isn't with writing them down but with people finding them if they are written down. This means not putting passwords on a post-it on the monitor and to guard them like you guard your wallet or house "keys", wherever they are written down or otherwise recorded. Of course, with so many passwords in one place, it's best to do a little planning in case a paper gets lost or wet. It's also a good idea to consider what might happen if ALL passwords get disclosed at once.

midgetjones 10y ago
If they just steal your computer, they'll most likely still be logged in to many services already. If there's no password at login, they can already request a password change and a confirmation email from any other site. Not to mention autofill - my Dad is a terror for this. He sees it as a convenience, but I'm pretty sure his autofill could file his tax return for him by now.
- IncRnd 10y ago
  This is what disk encryption targets.
taserian 10y ago
One way of semi-resolving the issue of the paper falling into another's hands is writing the password and adding characters to it on paper that you know not to add when using it as a password. For example, when we visit my mother-in-law, she likes to hand over her ATM card for us to do local errands. My wife, knowing that she'll forget the PIN, writes it as a telephone number, where she knows the offset/method to extract the PIN.