Microsoft security guru: Jot down your passwords (2005)
cnet.com
cnet.com
> I write my passwords down. There’s this rampant myth that you shouldn’t write your passwords down. My advice is exactly the opposite. We already know how to secure small bits of paper. Write your passwords down on a small bit of paper, and put it with all of your other valuable small bits of paper: in your wallet. [1]
I think this is a viable strategy. And I don't think the fact that a wallet can be lost or stolen should dissuade a person. If your wallet is stolen, you're already facing a security compromise, with or without written passwords inside. Your typical wallet is going to contain ID cards, bank and credit cards, etc. You already need to cancel those cards and get new ones issued. Fortunately, by being in the wallet, those passwords will be rather secure. IME, people seem to understand losing one's wallet is Serious Business.
The common advice against writing passwords down is not the only bit of perverse security policy I've encountered. On the AIX boxes at one my employers, it wasn't so bad that password policy required a minimum length of multiples of letters, numbers, and symbols and forbade reusing the past N passwords. No, what was BS was that the policy also forbade X repeated letters, and Y letters that were in any of the Z previously used passwords. Now, while this might have been intended to prevent users from using passwords like "aabbccdd1", "aabbccdd2", "aaaabbbb3", etc, it also in effect forbade stronger passphrases. The longer a passphrase is, the more likely you are to have multiple repeated letters, or letters that occurred in the last few passphrases. There are only 5 vowels in the roman alphabet, and many words use more than one. For example "correcthorsebatterystaple", has 6 repeated letters, and its replacement of "wargnomefinaltreetruce" not only has 4 repeated letters, but 5 letters used in the previous passhrase, thus forcing a much weaker password like "FuckA1X!". Oops.
1. http://freakonomics.com/2007/12/04/bruce-schneier-blazes-thr...
This means not putting passwords on a post-it on the monitor and to guard them like you guard your wallet or house "keys", wherever they are written down or otherwise recorded.
Of course, with so many passwords in one place, it's best to do a little planning in case a paper gets lost or wet. It's also a good idea to consider what might happen if ALL passwords get disclosed at once.
Not to mention autofill - my Dad is a terror for this. He sees it as a convenience, but I'm pretty sure his autofill could file his tax return for him by now.
For example, when we visit my mother-in-law, she likes to hand over her ATM card for us to do local errands. My wife, knowing that she'll forget the PIN, writes it as a telephone number, where she knows the offset/method to extract the PIN.
Uhhh..
Plus, leaving my house unlocked has no utility, whereas having a scannable copy of my master password with me at all times does.
Finally, the consequences of my house getting broken into are pretty bad. But even if I did lose my wallet it's virtually certain to be someone that knows nothing about password managers, and changing my master password is pretty easy.
Plus I use it once a month or so when my password manager app on my phone gets logged out and I don't feel like pecking it into the virtual keyboard.
Being able to scan it when needed allows me to use a password manager for all my other passwords and keeps me using a complex-enough master password.
It's the same argument as the article, just at one higher level of abstraction.
There's also the risk of creating weak passwords so that they're easier to type. Ideally, your password would be generated randomly by a computer, or using other methods, like dice (e.g. https://www.eff.org/dice).
I personally think that jotting down passwords physically is worse than saving passwords in a good password manager. Now, there are a few good ones, like 1Password[2].
So no, I disagree with this security guru's advice with the exception of 2FA recovery codes.
[1] https://en.wikipedia.org/wiki/List_of_password_managers [2] https://en.wikipedia.org/wiki/1Password
Can malware or a MITM attack compromise connecting to a password manager? It seems like anyone anywhere could gain access to the password managers severs(exploit) or my computer (malware).
For paper password, someone would need to know my address and then break into my house.
I personally just use memory.
If you get infected by malware then it could just grab the password as you type it anyway; if anything then using a password manager is slightly more secure, since browser integration goes over an authenticated connection that is harder for non-root applications to intercept.
If you were good at securing physical objects then you could just lock down the computer instead, and stop bothering with passwords.
Quote: I write my passwords down. There's this rampant myth that you shouldn't write your passwords down. My advice is exactly the opposite. We already know how to secure small bits of paper. Write your passwords down on a small bit of paper, and put it with all of your other valuable small bits of paper: in your wallet.
An aside, I use KeePass and strictly use it offline with a secret key and passphrase. Browser integration and mobile and desktop KeePass apps are not really polished and all have their own quirks. I've noticed a huge audience of 1Password and other password managers that store the passwords in the cloud. The apps and integration look good but I can't justify trusting somone else to handle my data. Am I being too paranoid?
So having this list of passwords on a piece of paper (or whatever) becomes difficult since I'd need to consult it many times, leading to:
1. Higher risk of someone stealing it from me.
2. Higher risk of losing it.
So far, I've used some mental mneumonics to remember passwords (which is not safe since it can be easily discovered by a machine learning algo for example) + 2 factor auth.
I wonder if there's a better option though.
It can take a while to encode/decode each time, but it does somewhat solve the problems you mentioned.
You might be surprised how little effort it takes to memorize. Half an hour a day for a few days can do it for a lot of people, followed by putting it in to practice.
The password creation process:
[~8 characters including lowercase, uppercase, and special characters]
+
[a secret word or set of characters ~8 characters long]
+
[a simple encryption method for the alphabet which you use to write the service's name down]
eg. [qWeRtY4$] + [bananas] + [ibdlfsofxt]
Which comes out to: qWeRtY4$bananasibdlfsofxt
Decrypter for the last section ('ibdlfsofxt' is 'hackernews'):
a = b
b = c
c = d
d = e
e = f
f = h
h = i
i = j
j = k
k = l
l = m
m = n
n = o
o = p
p = q
q = r
r = s
s = t
t = u
u = v
v = w
w = x
x = y
y = z
z = a
Take those three steps and randomize them or make them something unique to you and you're good to go.
Probably the most important part of your password is the length. The longer a password is, the longer it will take for software to break it with brute force. If the service you're using has a three character name, you'll be relying on the first two parts of your passwords to reach a good length. It's good to keep those two at a combined length of around 14+ characters.
eg. [1234567]+[1234567]+[aws] = 17 characters
Some problems with this method:
A: If your password requires changing.
- To solve this, you could choose a character in the first sequence that you can increment every time you have to change your password. You could also choose a different word for the second section. Plan ahead for this scenario.
B: The service you are using doesn't allow a password with one of your special characters.
- You could try using special characters that are very commonly accepted when you create your password, such as the exclamation mark. Though, this _does_ take away from the security.
- You could also have a secondary password; one that is simplified and doesn't rely on special characters. You can have this as a backup for services that have limiting password requirements.
eg. [qwerty]+[bananas]+[ibdlfsofxt]
C: The service you're using doesn't allow a password of that length.
- As with problem B, you could have a secondary password ready ahead of time, . eg [tY4$] + [ibdlfsofxt]
If somebody takes your card, you still know the secret, and that could be any number of characters you wanted it to be.
For example you have:
[qWeRtY4$] + [bananas] + [ibdlfsofxt]
If your password is exposed:
[qWeRtY4$] = remains the same for all passwords
[bananas] = remains the same for all passwords
[ibdlfsofxt] = changes for all passwords
Cracking the part that "changes" is probably not going to be difficult for a machine since you are associating the place name (hackernews or aws) with the part that changes (same number of characters). Then it won't take long for a machine to guess that you are replacing with the next alphabet letter or something else that is easy for a human to remember.
In that sense, I believe QWERTY cards are a bit more secure in this sense since it's just random characters assigned to each key, and each card is unique. It takes away the "easy to remember" part since you will have to look at the card, but it will be some orders of magnitude harder for a machine to guess it.
After multiple breaches, however, your encryption table might be exposed too. At this point you will have to change your passwords and get a new card. Probably do it every 3 months?
I don't know, sounds like a lot of work and maybe too paranoid, but I'm hopeless when thinking about password creation and making it easy to remember.
If someone does crack it, at least I have a handy database of websites and logins I have to change the password for.
[0] https://www.amazon.com/Integral%C2%AE-8GB-Crypto-Drive-Encry...
I will add that it is more cumbersome than it needs to be for family. I highly encourage everyone to make sure immediately family is joint owner of critical things. Makes transitions much easier. (Though, yes, there are valid reasons not to do that.)
Hackers from an enemy state, rival company, or government agency? Yea, they'll probably hack your password manager.
Co-worker, ex-girlfriend, etc? They'll break in your house, office, or desk.
For example, something like this
[$#__1077__#$]---!SERVICE!USERNAME!
So, for Hackernews, I would use h for hackernews and t for theduke --> [$#__1077__#$]---!h!t!
Now all I have to remember is the template and my username.
For accounts that need regular password changes I'll add an additional part that identifies the year and the quarter.
Of course, if someone where to get a hold the cleartext password for one site, they might be able to figure out the scheme and get into all my accounts.
But that's a risk I'm willing to take (except for very important accounts/passwords, which get randomly created).
In today's world with widespread internet connectivity and dozens of passwords to manage, password managers and/or writing down and (certain) dual factor identification approaches make more sense...
I was given a random password for an account years ago and came up with a sentence that I associate with the original random password.
Whenever I use that random string in a password and I want to write down the password, I record that sentence instead of the original random string.
That way anybody that finds what I've written can't really use it.
Write down or save most of your password in a password manager. Add a secret prefix or suffix string to this password from memory when logging in.
This effectively gives you MFA. Something you have, something you know.
Every login gets a different password (that you don't have to remember) yet nobody knows the real password even if the password manager or piece of paper is compromised.