4 ms·
Paper is an awful medium for password management, for a host of reasons: 1. It's vulnerable to phishing. The vast majority of sites still do not support U2F or
by charleslmunger 8y ago
Paper is an awful medium for password management, for a host of reasons:
1. It's vulnerable to phishing. The vast majority of sites still do not support U2F or similar, and typing in a password from paper means that a human is validating the domain, not a machine.
2. It's not encrypted at rest. This means that leaving your wallet somewhere means all your passwords have been exposed. It also means in many legal cases (IANAL, US law, etc) the contents of that paper are a key to all the other encryption you might have. In particular, courts have held that the fifth amendment protects a defendant from being compelled to reveal passwords in many circumstances.
3. It's difficult to keep in sync with new registrations, logins, and password changes - given the widespread use of mobile phones, it means that you are likely to take that piece of paper with you, compounding the risks in #2
5. Paper isn't durable. Spill a drink on it and everything is basically gone.
6. Paper isn't generally structured to obscure passwords - open your browser's password manager, and you'll see for each password unless you click to reveal it. With paper, you are much more vulnerable to shoulder surfing.
Edit:
7. Any decent password manager will volunteer to generate passwords for you - if you're doing this on paper, it's much more likely that you'll try to come up with a password yourself, resulting in weaker passwords.
- nickpsecurity 8y ago"5. Paper isn't durable. Spill a drink on it and everything is basically gone." Paper is more durable than any digital storage which all suffer from rot. They also rot faster than advertised. My documents stored in water- and fire-resistant containers will be readable even when my HD or discs fail. Just like the old books I find at thrift stores that were already older than some corrupted media I had.
- craftyguy 8y agoWhy wouldn't you create encrypted backups of your password manager stuff, or use a password manager than does this inherently by design (e.g. password-store/pass)?
- nickpsecurity 8y agoI have digital and paper backups. Having lost 3 HD's in a month, Im about to add another online service to mix with durability protections.
- kungtotte 8y agoMay I suggest not subjecting your drives to water, fire, concussion, or whatever it is you are currently doing?
- freehunter 8y agoPaper is certainly not more durable than digital storage. It may last longer at rest, but a disk under constant usage will outlast paper under constant usage any day. Durable means able to resist wear. Lasting means persisting over an extended period of time. Paper, when stored properly, is long-lasting. It is not durable.
- Retric 8y agoA poster on a wall could last for decades to centuries of use after a HDD in constant use has died. So, really HDD win in a subset of cases and lose in others.
- freehunter 8y agoIs a poster on a wall considered "paper in constant use"? After all, that disk has been constantly, unceasingly physically manipulated for years, while the paper has just been merely subjected to light and a small amount of air movement. A poster on the wall is as much "in use" as a disk that is plugged in but not mounted. Sticking with the original subject, write your password to your computer disk and write it to a piece of paper. Now change your password on your computer disk while changing it on the paper as well. Now change it again. And again. And again. See what is more durable, the disk being constantly erased and written over, or the paper being constantly erased and written over? A modern SSD can handle tens of petabytes being written before it dies. Can a piece of paper?
- deleted 8y ago[deleted]
- yifanl 8y agoBut that isn't at all relevant to the use case at hand. Using paper storage just means you can access and read the content of the paper.
- freehunter 8y agoSo you just never change your passwords?
- Finnucane 8y agoMy paper notes are encrypted. My encryption method is called ‘my handwriting.’ It is indecipherable. Sometimes even to me. I would never use a browser’s password manager.
- brennebeck 8y agoI literally laughed out loud reading this. Just wanted to convey my thanks. Edit: In a good way, I mean.
- lou1306 8y ago> My encryption method is called ‘my handwriting.’ B-but that's basically just a substitution cypher!