Most places force you to rotate the password so I would not say it is a responsibility to not write it down.
I do it. It is like there is a fixed number of passwords per life you can remember or something.
Most places force you to rotate the password so I would not say it is a responsibility to not write it down.
I do it. It is like there is a fixed number of passwords per life you can remember or something.
I know some places have rules like “must have at least N characters different from previous passwords”. However, depending on the exact rule, people can come up with easy-to-remember workarounds: e.g. the “blah” bit is ”foo” in even months and “bar” in odd ones.
An attacker can only hack the paper with physical access to my office. But if they have that, they might as well install an physical keylogger.
You can also combine a written down fragment of the password with a remembered one.
... and there are lots of unrelated people with physical access to your office. Cleaning staff, building maintenance, HVAC technicians, printer service staff... and all of these may not have the same level of background checks as your company has.
And even if you hire all of these yourself (which makes sense at a certain scale), that still doesn't protect you against marketing inviting a camera crew and walking around everywhere in one of these typical "life at the office" short films for Linkedin. IT staff offices seem to be very popular for such films since they're usually the most personalized rooms with lots of nerd stuff on the walls and desks.
Besides: swiping a photo of a post-it leaves no evidence, whereas installing a physical keylogger certainly does.