4 ms·

Writing down passwords is usually less bad than password reuse and use of weak passwords.

by ryan-c 8y ago

jki275 8y ago
Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.
- taco_emoji 8y ago
  It depends on the threat vector, though. Printing out my passwords in 72-pt font and taping them to the wall is obviously insecure if I leave them up for the house cleaner to see, but there's zero risk that a remote attacker will see them (barring them taking over the webcam or something, but at that point they probably have root access anyway).
  - jki275 8y ago
    Or paying your housecleaner to take a picture and email it to them...
jermaustin1 8y ago
Its the same concept of the majority of offline password managers. You are hiding all of your amazing 32 character randomly generated unique passwords behind a single memorable password. BUT its safe, because unless YOU are the target of the attack, the contents of your random slip of paper on your desk, or the password protected one note file on your dropbox, or the encrypted pwsafe3 file on your usb stick are outside of the reach of some bad actor trying to get ALL of the passwords, not just YOUR password.
- ryan-c 8y ago
  Did you reply to the wrong comment? Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.
  - jermaustin1 8y ago
    No, I'm saying writing your password down in a notebook on your desk in your locked office is nearly as safe as any offline password manager. If you aren't the one under attack, and you still create different passwords for each service, the method of offline password storage (be it a spread sheet, a password manager, or a sticky note) are all similarly-ish safe.

Writing down passwords is usually less bad than password reuse and use of weak passwords.

by ryan-c 8y ago

Writing down passwords is usually less bad than password reuse and use of weak passwords.

Depending on the physical security posture of the location where the passwords are stored, that can be a correct statement. I wouldn't argue "usually" simply because most people aren't smart about where they're stored.

taco_emoji 8y ago
It depends on the threat vector, though. Printing out my passwords in 72-pt font and taping them to the wall is obviously insecure if I leave them up for the house cleaner to see, but there's zero risk that a remote attacker will see them (barring them taking over the webcam or something, but at that point they probably have root access anyway).
- jki275 8y ago
  Or paying your housecleaner to take a picture and email it to them...

jermaustin1 8y ago

Its the same concept of the majority of offline password managers. You are hiding all of your amazing 32 character randomly generated unique passwords behind a single memorable password. BUT its safe, because unless YOU are the target of the attack, the contents of your random slip of paper on your desk, or the password protected one note file on your dropbox, or the encrypted pwsafe3 file on your usb stick are outside of the reach of some bad actor trying to get ALL of the passwords, not just YOUR password.

ryan-c 8y ago
Did you reply to the wrong comment? Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.
- jermaustin1 8y ago
  No, I'm saying writing your password down in a notebook on your desk in your locked office is nearly as safe as any offline password manager. If you aren't the one under attack, and you still create different passwords for each service, the method of offline password storage (be it a spread sheet, a password manager, or a sticky note) are all similarly-ish safe.