4 ms·

I have 50+ entries in my password manager. Even if I use passphrases, I couldn't remember them all. There's no such thing as perfect security, and IMO a good m

I have 50+ entries in my password manager. Even if I use passphrases, I couldn't remember them all. There's no such thing as perfect security, and IMO a good middle ground is memorizing a long, strong passphrase to unlock a password manager full of random PWs for individual sites. I guess you could write them down instead, but personally I'm much more worried about someone stealing a physical notebook than getting malicious software onto my computer. (For example, what happens when you cross a border and an enterprising young border officer photographs the contents of your passwords notebook? This would be perfectly legal in most countries.) I would assume if that were the case they can intercept the password from the paste buffer anyways.

SlowRobotAhead 8y ago
50+, that sounds nice. I have 300+ and they are all 20 char random except where dumb sites required special rules like 14 char max. Asking someone to brain more than 5 good passwords is entirely pointless. We just aren’t wired for that. I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good.
- dontbenebby 8y ago
  >I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good. I agree, what is "good enough" security depends on your threat model. For example, for an older adult who previously used one dictionary word on every site, a small notebook with a list of PWs in a locked desk drawer is a big step forward. I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use).
  - SlowRobotAhead 8y ago
    >I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use). Does that system fall apart if you need to securely and remotely share a password with your mom? Because that is the standard of usability I've been considering.
    - dontbenebby 8y ago
      Who is your threat model when sharing a password with your mom? If it's not the government, isn't a phone call sufficient? Harder to tap, and presumably she knows your voice.
      - SlowRobotAhead 8y ago
        You want to call my mom and read her an 18 char password? I'll give you her number, let me know how it goes! So I think it should be obvious when I say my mom, that's a user I have no control over, I can't yell at, I want to make sure there are no mistakes, and that she can't mess anything up on her end like writing it on a sticky note... If you haven't figured out, mom is the worst possible case for a user. You're getting lost in the details. It should be SIMPLE to securely share credentials or codes or details with someone, and that can't be done if a piece of paper is your system.
ocdtrekkie 8y ago
Your threat assessment is backwards. Someone needs physical access to your computer area to steal your notebook. Anyone anywhere on the globe can make a reasonably trivial attempt to get malicious software on your computer. At any given time, the number of people who can attack your notebook is... maybe five. The number of people who can attack your computer at any given time is seven billion. (Also, there are trivial things you can do to make a paper notebook even better. Write the passwords consistently slightly wrong, according to a rule that you only know in your head, or have a common part of all of your passwords only you know, and then use the notebook for uniqueness.)

SlowRobotAhead 8y ago

50+, that sounds nice. I have 300+ and they are all 20 char random except where dumb sites required special rules like 14 char max. Asking someone to brain more than 5 good passwords is entirely pointless. We just aren’t wired for that. I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good.

dontbenebby 8y ago
>I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good. I agree, what is "good enough" security depends on your threat model. For example, for an older adult who previously used one dictionary word on every site, a small notebook with a list of PWs in a locked desk drawer is a big step forward. I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use).
- SlowRobotAhead 8y ago
  >I like to tell people to treat passwords they have written down like they would a hundred dollar bill. (You keep it on your person, or lock it up when not in use). Does that system fall apart if you need to securely and remotely share a password with your mom? Because that is the standard of usability I've been considering.
  - dontbenebby 8y ago
    Who is your threat model when sharing a password with your mom? If it's not the government, isn't a phone call sufficient? Harder to tap, and presumably she knows your voice.
    - SlowRobotAhead 8y ago
      You want to call my mom and read her an 18 char password? I'll give you her number, let me know how it goes! So I think it should be obvious when I say my mom, that's a user I have no control over, I can't yell at, I want to make sure there are no mistakes, and that she can't mess anything up on her end like writing it on a sticky note... If you haven't figured out, mom is the worst possible case for a user. You're getting lost in the details. It should be SIMPLE to securely share credentials or codes or details with someone, and that can't be done if a piece of paper is your system.

ocdtrekkie 8y ago

Your threat assessment is backwards. Someone needs physical access to your computer area to steal your notebook. Anyone anywhere on the globe can make a reasonably trivial attempt to get malicious software on your computer. At any given time, the number of people who can attack your notebook is... maybe five. The number of people who can attack your computer at any given time is seven billion. (Also, there are trivial things you can do to make a paper notebook even better. Write the passwords consistently slightly wrong, according to a rule that you only know in your head, or have a common part of all of your passwords only you know, and then use the notebook for uniqueness.)