> I write my passwords down. There’s this rampant myth that you shouldn’t write your passwords down. My advice is exactly the opposite. We already know how to secure small bits of paper. Write your passwords down on a small bit of paper, and put it with all of your other valuable small bits of paper: in your wallet. [1]
I think this is a viable strategy. And I don't think the fact that a wallet can be lost or stolen should dissuade a person. If your wallet is stolen, you're already facing a security compromise, with or without written passwords inside. Your typical wallet is going to contain ID cards, bank and credit cards, etc. You already need to cancel those cards and get new ones issued. Fortunately, by being in the wallet, those passwords will be rather secure. IME, people seem to understand losing one's wallet is Serious Business.
The common advice against writing passwords down is not the only bit of perverse security policy I've encountered. On the AIX boxes at one my employers, it wasn't so bad that password policy required a minimum length of multiples of letters, numbers, and symbols and forbade reusing the past N passwords. No, what was BS was that the policy also forbade X repeated letters, and Y letters that were in any of the Z previously used passwords. Now, while this might have been intended to prevent users from using passwords like "aabbccdd1", "aabbccdd2", "aaaabbbb3", etc, it also in effect forbade stronger passphrases. The longer a passphrase is, the more likely you are to have multiple repeated letters, or letters that occurred in the last few passphrases. There are only 5 vowels in the roman alphabet, and many words use more than one. For example "correcthorsebatterystaple", has 6 repeated letters, and its replacement of "wargnomefinaltreetruce" not only has 4 repeated letters, but 5 letters used in the previous passhrase, thus forcing a much weaker password like "FuckA1X!". Oops.
1. http://freakonomics.com/2007/12/04/bruce-schneier-blazes-thr...