4 ms·
On this point: > write passwords down in places that are easy to find (like post-it notes next to the screen) Writing passwords on post-it notes is often used
by godot 6y ago
On this point:
> write passwords down in places that are easy to find (like post-it notes next to the screen)
Writing passwords on post-it notes is often used as a ridicule of non-tech-savvy folks behavior. I'd like to pose this question: If you're doing this not at an office, but at home, is this really so bad?
Say you run a web site on AWS and write your really long AWS password on a piece of paper at home. It would take a hacker finding out where you live and breaking into your house to find the piece of paper to access it. On the other hand, your ordinary neighborhood burglars typically care about cash and jewelry in your house, not post-it notes with passwords. It seems those two categories of intruders rarely overlap, unless you're a world famous target.
- ramraj07 6y agoThis is changing though. More and more people are becoming sufficiently savvy that if they find a password when they break in (and they're criminals to begin with), perhaps they can then try it with many common websites.
- viraptor 6y agoHave you got any evidence for it? There's next to no monetary gain from any online account and even breaking into someone's bank online means you need to find a way to transfer money without leaving a trace and without extra transfer validation. Who would trade an extra minute when they can get caught for a random password?
- Gibbon1 6y agoOne solution is to use an easy to remember prefix with your passwords and only write down the secure part. Password is mayfly-DyHpE82sd3r3rvr!2sDQ Part you write down is DyHpE82sd3r3rvr!2sDQ
- namdnay 6y agoI used to write down numerical passwords interspersed number by number with a friends telephone number. Not exactly military grade security but enough to make it non obvious to someone looking through
- choeger 6y agoYou could also hash it with a common hash function and use the first X letters of the result string (if the website does not DEMAND "special characters", that is).
- stjohnswarts 6y agoThis is what I do with my post it passwords at home :)
- viraptor 6y agoThe threat model is always important. What does your home look like? Who are you protecting from? If your current home is a shared student accommodation, post-its are probably a bad idea. If you live with potentially abusive family members, it may be a bad idea. But in many cases when you don't live your life online and login everywhere with your Google account federation - sure write it on a post-it. It's not good enough though if you have 20+ accounts and would make you share a password between them.
- gen3 6y agoYour very right. It’s all about threat models. I would rather my grandma (or really anyone that would have a hard time dealing with a password manager) have a password journal then all her passwords be the exact same thing.
- pmontra 6y agoI know a person with many sheets of paper filled by site makes and their passwords. Basically a password manager on paper. It's an excellent protection against password stealing malware but it's very bad if a burglar enters the house and also steal the passwords. It's also a pain to look for a site (the passwords are not on an old fashioned phone numbers agenda) and to type the passwords every time.
- darepublic 6y agoTo be fair even in the event of burglary they might not steal a piece of paper
- GhostVII 6y agoI do this, but also have a small prefix I add to the start of each password which I don't write down. The biggest threat is probably someone I know finding the passwords and trying to use them, so the odds of that kind of person actually brute forcing the prefix are pretty low.
- kybernetikos 6y agoBig problem is that if you have a break in you don't know if the theif was tech savvy or not, and you should assume your passwords are compromised.
- PeterisP 6y agoBreak ins are rare (I mean, most people will never have one in their lives); and if your threat model assumes have a tech-savvy thief then all your accounts should be considered compromised anyway since it's likely that some of the stolen devices will include some access tokens/cookies that could grant access to some accounts which then can be escalated to e.g. reset passwords to other accounts.
- pbhjpbhj 6y agoAlso, with a break-in you're likely to know - with a computer file you're less likely to know it's compromised.
- mnw21cam 6y agoJust make sure you don't accidentally broadcast your most valuable passwords over your video conference.
- cortic 6y ago>If you're doing this not at an office, but at home, is this really so bad? Yes. Keylogger and Webcams and untrustworthy roommates/family members/landlords are all low threat but; This encourages people to use the same password for multiple sites/services so as not to get overwhelmed by sticky-notes. So whenever one of those are breached, your email:pass combo becomes public knowledge.