3 ms·

I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of h

I have a file on the local drive of my office computer and a sheet of paper near my home computer (used by me and my wife). When the sheet of paper is full of handwriting, I bring it to office to synchronize both list.. When my house has been robbed last year they have not found the sheet, but if they had, I could have changed all passwords very quickly. In case of fire, the backup is safe in a remote location. It is easy to carry, duplicate or destroy. The security at office is ensure by the IT service. This may be imperfect, but I think my list of password would not be the main target of an attack. At home, my wife is often present and would quickly notice if a burglar steal the list. When I go on holidays, I take the home list with me. I think it is quite successful.

c22 9y ago
The actual attack to be worried about is that an adversary copies the sheet of paper without your knowledge. There's no need for an attacker to remove the physical list or to be a burglar. It could be someone you know.
- reacweb 9y ago
  Yes. I carefully lock my screen when I leave my office and the sheet of paper is not in plain sight.
clort 9y ago
> I think my list of password would not be the main target of an attack. I used to have a little notebook with everything, tucked 'securely' out of the way. I mean, even in a robbery somebody isn't going to rifle through some junk on a shelf right? I came to think though, that in that situation of course a list of passwords is not the target but if the robber has a small amount of technical knowledge (getting more likely, these days) then the risk is that they recognize the value of something like a book of passwords and just take it along. All of a sudden, their technology aware friend has access to my bank account! So, I use Keepass now with a long passphrase, and syncthing keeps copies of the database distributed across several devices in several locations for me and I have access from all the various operating systems that I use. I am thinking about giving the passphrase to a friend also, as I have known him for 30+ years but I do not work with him or live near him and see him only yearly or less.
- n4r9 9y ago
  Keepass-plus-syncthing is my weapon of choice also. Using your phone as one of the devices gets around the whole "bring your sheet of paper to work day". It would be great if someone added this feature into Keepass so that you didn't have to use an additional tool. Each instance of a database would have its own key and set of linked databases. When you open the database it would sync with every one of its linked databases that is also open. This would (hopefully?) get around the problem of adding new passwords to different databases before syncing. I expect one issue might be that people tend to only log into one instance of their database at a time.

c22 9y ago

The actual attack to be worried about is that an adversary copies the sheet of paper without your knowledge. There's no need for an attacker to remove the physical list or to be a burglar. It could be someone you know.

reacweb 9y ago
Yes. I carefully lock my screen when I leave my office and the sheet of paper is not in plain sight.

clort 9y ago

> I think my list of password would not be the main target of an attack. I used to have a little notebook with everything, tucked 'securely' out of the way. I mean, even in a robbery somebody isn't going to rifle through some junk on a shelf right? I came to think though, that in that situation of course a list of passwords is not the target but if the robber has a small amount of technical knowledge (getting more likely, these days) then the risk is that they recognize the value of something like a book of passwords and just take it along. All of a sudden, their technology aware friend has access to my bank account! So, I use Keepass now with a long passphrase, and syncthing keeps copies of the database distributed across several devices in several locations for me and I have access from all the various operating systems that I use. I am thinking about giving the passphrase to a friend also, as I have known him for 30+ years but I do not work with him or live near him and see him only yearly or less.

n4r9 9y ago
Keepass-plus-syncthing is my weapon of choice also. Using your phone as one of the devices gets around the whole "bring your sheet of paper to work day". It would be great if someone added this feature into Keepass so that you didn't have to use an additional tool. Each instance of a database would have its own key and set of linked databases. When you open the database it would sync with every one of its linked databases that is also open. This would (hopefully?) get around the problem of adding new passwords to different databases before syncing. I expect one issue might be that people tend to only log into one instance of their database at a time.