Hacker News Reader

Comment by ajuc | Hacker News Reader

I think it's time to change the 90s-inspired security recommendations.

I work from home. I feel much safer with my password written on a piece of paper than with a password manager. God forbid the password manager is cloud-enabled.

View on HN

The whole concept of "my password" is horribly insecure, as if you use the same password everywhere, there is a big risk that one of the sites leaks your password and then all your accounts are compromised. Whatever risks a cloud-enabled password manager has, reusing a single password is so much worse that those things aren't even comparable.

Having all your passwords on a piece of paper could be safer than a password manager, but it's so inconvenient to store a hundred different random passwords this way that people simply won't do it and will reuse passwords. So if password managers get people out of the password reuse trap, they're a net gain in security, that far outweighs all the password manager risks.

To be more specific I use a system with 3-part passwords.

The first part is generated from the website/system.

The second part is the code phrase - this is the part that I need to remember (and for passwords I use rarely - that I need to write down).

The 3rd part is changing predictably every time the system is forcing me to change my password.

The stuff I am writing down I'm writing using a script I created long ago for my TTRPG. It's not hard to decrypt if you had whole pages of it, but it's not a trivial substitution. I used it as a puzzle in my D&D campaigns for friends (including people with PhD in CS and MA in math) and they couldn't solve it over several weeks without a lot of hints. I don't think a random guy who broke in will solve it looking at a piece of paper with 10 or 30 symbols.

This is definitely reasonable if you like to use readable and easily-typed passwords (like Diceware/"correct horse battery staple"-style). A software password manager has an advantage for long, completely random, absolute gibberish passwords, because you don't even have to know what it is: you can just copy-paste or autofill it.

Another advantage of autofill is that it's more resistant to phishing attacks.

You aren't avoiding this problem though, just like this exploit requires physical access to disk, someone with physical access to your piece of paper negates any benefits. Even worse when people are recommending keeping your passwords in your wallet, something people lose quite often and due to cash interest there's a high incentive to stealing.

That doesn’t solve the problem of having 40 different passwords, at least half of which have to be changed on a regular basis, NIST guidelines be damned.

That just turns your piece of paper into a password manager that isn't secured with a password and doesn't require access to your device. I think the best option is an offline password manager on the device, and a hard copy of important passwords saved in a safe deposit box. The hard copy should be safe enough most of the time, and so should the copy on your device unless that device is already compromised or in the hands of attackers in which case, it's game over anyway.

No worries about the cloud that way, and you're free to use whatever means you're most comfortable with to handle updating databases between devices, but it does leave you on the hook for keeping and maintaining regular backups.

Aren't you incredibly vulnerable to Credential Stuffing (https://en.wikipedia.org/wiki/Credential_stuffing)?

Special password books exist.

https://www.amazon.co.uk/password-book/s?k=password+book

Often people will mock them on social media for the likes, but actually in some circumstances ... I think they are the best option.

(They can be made stronger too - tell people to remember one word that they put in front of all their passwords but don't write down, like "cat". Then anyone who steals the book can't use it but they are still using different passwords for each site.)

I have always felt the same. For me it is easy enough to have a little password book with everything written down. People often say what happens if there is a fire. I don’t have an answer to that but I have made it over 4 decades and not once had a fire so I’m going to believe the odds are I will not ever have a fire and chance it. Most things are recoverable with my phone number these days anyways. A much greater risk would be someone gaining access to my phone

If you have a fire, you'll just do what my wife does with _every_ password field she needs to use. You'll press the "forgot password" button.

God help her if she needs to log into her email after I'm dead.

I think Bruce Schneider recommended that most people should just keep their password in their wallet.

Source: https://www.schneier.com/blog/archives/2005/06/write_down_yo...

But he also wrote his own password manager: https://www.schneier.com/academic/passsafe/

Reply on news.ycombinator.com