#PasswordBooks are a bad idea right? RIGHT?! Well...I'm not so sure.
@zangetsu_MG @kev there are a couple of downsides though:
a) If you're out and about with your laptop, a password book might be easy to "accidentally misplace"
b) If you lose your password book, you're screwed
This is why some people go "full old school" and keep a text file on an encrypted disk. You can print an offline backup you keep in a lockbox and you can still paste passwords into webforms instead of typing them in (dodging keyloggers)
@zangetsu_MG @kev disclaimer: I'm one of those people.
Although I have been experimenting with Firefox Sync + a master password recently to see if the convenience is worth it.
@bobstechsite @zangetsu_MG I agree, it's not perfect, but nothing is.
The likelihood is that browsers etc. will be set to remember logons (as that's what most people do), so I think that would probably negate the need for the book when "out and about". Certainly this would be the case on a mobile device.
@kev @bobstechsite @zangetsu_MG I used to record them all in my Bullet Journal, Keepass works these days. Completely agree with the lack of security mentioned, and not really mattering.
@bobstechsite tbf this is greatly facilitated by utilities like pass which still work via copy and paste but allow easier searching, updating etc
Some thoughts on this Show more
Some thoughts on this Show more
@kev now I'm thinking I should get some password books for my family members.
@kev Great article Kev, I fully agree.
I think it also signals to a deeper point of the importance of having a degree of understanding about the risks with tech we use.
"Grandma" probably understands the concept of lock-and-key better than encryption, so it's possibly best to put her in a UI environment more suited to her knowledge base, which in this case is physical security.
@ChrisWere absolutely, couldn’t agree more. I think people are too quick to jump on the high-tech bandwagon. Yeah, it’s great, but it isn’t always the best solution.
@kev so do you use a password book?
@kev
I actually use one myself at home, and I'm a Unix sysadmin. I do keep it locked up until I need it and then lock it back up once I don't, though, and I only record either very imprtant but hard to remember passwords or passwords I use so infrequently that memorizing them wouldn't be worth the effort.
Some times low tech really does work best.
@kev honestly any form of security that requires physical access is by default going to be fairly secure in the modern age
Like unless you’re high up in tech or the government, no ones going to go to the trouble of breaking into your house in the hopes of finding your email password or whatever
@Satsuma exactly.
@kev @DialMforMara I make it more secure by now wiring explicitly what password goes with what website, just a hint.
@kev The problem with "password on a post-it" was traditionally office environments, if I recall my 90's/00's correctly. People overgeneralized that to "never commit a password to paper" which is just... wrong? Like, I definitely have my key passphrases recorded on paper, because if I get hit by a bus my wife is going to need access to my files. The paper is just not in a very obvious place. :-)
I think even my credit union gets it: They said not to store my password in a Word document. :-)
@varx as long as you password protect that Word document, you'll be fine! 😂😂😂
@kev I think they're fine, and much better than reusing passwords.
HOWEVER, it does nothing to protect against an abusive or controlling spouse/parent/caretaker/etc.
As always: know your threat model 😊.
@webinista true. But I would argue that depending on the level of abuse seen, nothing would protect you. It's just as easy to abuse someone into handing over a book, as it is to handing over a LastPass password.
@kev @webinista This gives birth to my favourite term in cryptography: https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
@kev @bobstechsite This is a perfect example of academic theory not matching real world use. Anyone studying security academically will always tell you to never write down passwords, but this is a real world scenario where writing it down might actually be the best choice.