9 ms·

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same pl

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

ericd 5y ago
Time to revive the rolodex...
- sitkack 5y ago
  With a polarizing filter, oled display, vision based user recognition and a nice haptic knob, hopefully in some sort of upcycled oak, alder or white ash.
  - geoka9 5y ago
    Don't forget wifi connectivity...
    - lmohseni 5y ago
      A web based admin interface might be handy as well...
      - sitkack 5y ago
        Ohhh, with automatic firmware updates! Maybe it syncs over Bluetooth, or pretends to be a car infotainment system to keep a copy of your mobile contacts. The complexity probably warrants some sort of embedded microservice arch, like microK8S.
- dredmorbius 5y ago
  That was going to be my suggestion. I'm a fan of Zettlekasten for notetaking and knowledge management. Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure. The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within reason. Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge.
  - maccard 5y ago
    > Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offload that to a third party that I trust. [0] https://bitwarden.com/help/article/what-encryption-is-used/ https://bitwarden.com/help/article/what-encryption-is-used/
    - usrusr 5y ago
      Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.
      - maccard 5y ago
        So security through obscurity?
        usrusr 5y ago
        Yes, obscurity is great when used as an additional factor.
        tremon 5y ago
        I'd call it security through diversity.
      - pbhjpbhj 5y ago
        Security through obscurity, in other words (I've always been a fan, it works as an additional factor; not being sarcastic!).
    - dredmorbius 5y ago
      Not being dependent on some external maintainer outside your preferred editor and encryption tools. The ability to port to any alternative tools that provide superior capabilities, should the need arise. Utilising the file using standard shell tools (gpg piped to grep, sed, awk, etc.). I've been around long enough to see multiple tools come and go. Even PGP itself dates from after the beginning of my professional career with computers (though near the beginning). There are multiple applications, operating systems, and architectures I've used which have been relegated to the dustbin of history. I'm quite leery of becoming dependent on any one specific application or tool, most especially one that that's not been proven across multiple decades and widely adopted. PGP, GPG, vi/vim, or emacs would all pass my tests. They're available on any system I could conceivably use. Even iOS, though with some difficulty. Encrypting and syncing a file is simple. Managing syncs from multiple locations of an encrypted file is ... a bit more complicated. Git might be able to manage that with some hooks.
earthboundkid 5y ago
FieldNotesBrand.com Sticky notes suck because people leave them in plain sight. A notebook is a totally reasonable way for a non-technical person to track passwords securely.
- emodendroket 5y ago
  Yeah but unless you have a lot of foresight they’re not going to end up in a useful order.
  - jszymborski 5y ago
    You can just use an address book (the paper sort with letter dividers).
- PhantomGremlin 5y ago
  A notebook is a totally reasonable way for a non-technical person to track passwords securely. I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit. The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone". My reckless behavior reminds me of this commercial parody on SNL, long ago: - A Tradition of Security - We will make a list of our clients and how much money each of them has given us to invest. We will keep this list in a safe place. If we have time we will make a copy of the list in case something happens to the first list. http://www.faqs.org/faqs/tv/sat-night-live/commercials/ http://www.faqs.org/faqs/tv/sat-night-live/commercials/
  - throwawayboise 5y ago
    Do you have your password manager database and private keys backed up in a way that would survive if you have a fire? A lot of people may think they have backups of stuff like this but unless you remember to grab that thumb drive out of your desk drawer (assuming you're home) a fire might still destroy them.
    - 5y ago
yosito 5y ago
> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.
- mjthompson 5y ago
  > A piece of paper can easily be found by someone. Much easier than hacking a password manager. A piece of paper in a locked drawer is potentially accessible to a person breaking into it. It is probably an unsophisticated burglar looking for money. They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA. If they decide to swipe your notebook, it will be immediately apparent you have been compromised, as your drawer is open and your notebook open or missing. Your notebook may be looked at momentarily, perhaps passed to one or two people, more likely, it will be thrown into a gutter as soon as the burglar realises it has no money in it, or just left untouched. A password in a locked password manager is potentially accessible to a person breaking into it. It is probably a sophisticated cyberattacker looking for credentials. They are probably located overseas and have remotely connected to your home network, and will evade capture. They will leave no trace. If they decide to compromise your vault, it may not be immediately apparent you have been compromised, as your password manager is still there. Your vault will be scrutinised intensely, and your credentials will be sold to many others on a darknet forum. I know which I'd rather.
  - maccard 5y ago
    If someone has remotely compromised my home network how do I know they haven't just installed a keylogger, and are capturing the passwords that I type in via a sticky note? I'm just a person on the internet, so my threat model may be different to yours, but my threat model is for the most part phishing, social engineering, data breaches, and the likes. The majority of these are fixed by password autofill (for the most part)
  - usrusr 5y ago
    > It is probably a sophisticated cyberattacker looking for credentials It is probably the script of a sophisticated cyberattacker leveraging some vulnerability for looking for credentials of thousands of people at once. Yes, the burglar is a total non-threat by comparison (unless they happen to be working for your very personal enemy intelligence agency) Good security practice would add a memorized element to the stored passwords as an informal second factor. Are there password managers that have good support for that when auto-filling and updating?

A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.

ericd 5y ago

Time to revive the rolodex...

sitkack 5y ago
With a polarizing filter, oled display, vision based user recognition and a nice haptic knob, hopefully in some sort of upcycled oak, alder or white ash.
- geoka9 5y ago
  Don't forget wifi connectivity...
  - lmohseni 5y ago
    A web based admin interface might be handy as well...
    - sitkack 5y ago
      Ohhh, with automatic firmware updates! Maybe it syncs over Bluetooth, or pretends to be a car infotainment system to keep a copy of your mobile contacts. The complexity probably warrants some sort of embedded microservice arch, like microK8S.
dredmorbius 5y ago
That was going to be my suggestion. I'm a fan of Zettlekasten for notetaking and knowledge management. Filing passwords on index cards or business cards (3.5x2 in, ~9x5cm), with a sensible indexing system, scales up reasonably well. There's certainly extant physical infrastructure. The typical person has on the order of about 100 online accounts. Managing even 1,000 accounts in an index card file is at least within reason. Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge.
- maccard 5y ago
  > Another alternative is a GPG-encrypted file, though keeping that synchronised between multiple locations might prove a challenge. What's the difference between what you're suggesting here and a password manager? Enxrypted local file, with an optional sync service. I know that if I was setting up my own password manager for security reasons, the sync part is likely the most vulnerable, hence why I would like to offload that to a third party that I trust. [0] https://bitwarden.com/help/article/what-encryption-is-used/ https://bitwarden.com/help/article/what-encryption-is-used/
  - usrusr 5y ago
    Your personal convention that would keep you unaffected from bulk attacks targeting the tool used by millions in the same way.
    - maccard 5y ago
      So security through obscurity?
      - usrusr 5y ago
        Yes, obscurity is great when used as an additional factor.
      - tremon 5y ago
        I'd call it security through diversity.
    - pbhjpbhj 5y ago
      Security through obscurity, in other words (I've always been a fan, it works as an additional factor; not being sarcastic!).
  - dredmorbius 5y ago
    Not being dependent on some external maintainer outside your preferred editor and encryption tools. The ability to port to any alternative tools that provide superior capabilities, should the need arise. Utilising the file using standard shell tools (gpg piped to grep, sed, awk, etc.). I've been around long enough to see multiple tools come and go. Even PGP itself dates from after the beginning of my professional career with computers (though near the beginning). There are multiple applications, operating systems, and architectures I've used which have been relegated to the dustbin of history. I'm quite leery of becoming dependent on any one specific application or tool, most especially one that that's not been proven across multiple decades and widely adopted. PGP, GPG, vi/vim, or emacs would all pass my tests. They're available on any system I could conceivably use. Even iOS, though with some difficulty. Encrypting and syncing a file is simple. Managing syncs from multiple locations of an encrypted file is ... a bit more complicated. Git might be able to manage that with some hooks.

earthboundkid 5y ago

FieldNotesBrand.com Sticky notes suck because people leave them in plain sight. A notebook is a totally reasonable way for a non-technical person to track passwords securely.

emodendroket 5y ago
Yeah but unless you have a lot of foresight they’re not going to end up in a useful order.
- jszymborski 5y ago
  You can just use an address book (the paper sort with letter dividers).
PhantomGremlin 5y ago
A notebook is a totally reasonable way for a non-technical person to track passwords securely. I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit. The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone". My reckless behavior reminds me of this commercial parody on SNL, long ago: - A Tradition of Security - We will make a list of our clients and how much money each of them has given us to invest. We will keep this list in a safe place. If we have time we will make a copy of the list in case something happens to the first list. http://www.faqs.org/faqs/tv/sat-night-live/commercials/ http://www.faqs.org/faqs/tv/sat-night-live/commercials/
- throwawayboise 5y ago
  Do you have your password manager database and private keys backed up in a way that would survive if you have a fire? A lot of people may think they have backups of stuff like this but unless you remember to grab that thumb drive out of your desk drawer (assuming you're home) a fire might still destroy them.
  - 5y ago

yosito 5y ago

> A piece of paper is the most secure solution I beg to differ. A piece of paper can easily be found by someone. Much easier than hacking a password manager. Unless you're storing that piece of paper in a safe, it's not secure. The only advantage of paper is that it's not exploitable remotely.

mjthompson 5y ago
> A piece of paper can easily be found by someone. Much easier than hacking a password manager. A piece of paper in a locked drawer is potentially accessible to a person breaking into it. It is probably an unsophisticated burglar looking for money. They are probably located in the vicinity of your neighbourhood and have rocked up to your home, and will not evade capture for long. They will likely leave DNA. If they decide to swipe your notebook, it will be immediately apparent you have been compromised, as your drawer is open and your notebook open or missing. Your notebook may be looked at momentarily, perhaps passed to one or two people, more likely, it will be thrown into a gutter as soon as the burglar realises it has no money in it, or just left untouched. A password in a locked password manager is potentially accessible to a person breaking into it. It is probably a sophisticated cyberattacker looking for credentials. They are probably located overseas and have remotely connected to your home network, and will evade capture. They will leave no trace. If they decide to compromise your vault, it may not be immediately apparent you have been compromised, as your password manager is still there. Your vault will be scrutinised intensely, and your credentials will be sold to many others on a darknet forum. I know which I'd rather.
- maccard 5y ago
  If someone has remotely compromised my home network how do I know they haven't just installed a keylogger, and are capturing the passwords that I type in via a sticky note? I'm just a person on the internet, so my threat model may be different to yours, but my threat model is for the most part phishing, social engineering, data breaches, and the likes. The majority of these are fixed by password autofill (for the most part)
- usrusr 5y ago
  > It is probably a sophisticated cyberattacker looking for credentials It is probably the script of a sophisticated cyberattacker leveraging some vulnerability for looking for credentials of thousands of people at once. Yes, the burglar is a total non-threat by comparison (unless they happen to be working for your very personal enemy intelligence agency) Good security practice would add a memorized element to the stored passwords as an informal second factor. Are there password managers that have good support for that when auto-filling and updating?