Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Many companies have policy again writing passwords and paper and I wonder if there reasoning is sound. Is it always better to use a software password safe than writing passwords on paper? Here are some pros and cons I can think of:

Software password safe

pros
- easy organization
- convenient
- can backup (however you can write the password on two pieces of paper)
- can share via internet (paper you can share but only with people physically there)

cons
- if computer is unusable passwords are lost
- if vulnerability discovered could effect all password safes of the make
- obvious target (e.g. crook breaks in a computer is an obvious target, if he finds a password safe obviously passwords are inside)

Paper

pros
- cannot be stolen remotely
- no intrinsic parts therefore always able to use i.e. won't break down like computers do
- if forgotten where placed, given time the chances of someone looking for it finding it increase. In contrast if a person forgot a password to the password safe the longer they don't remember it the less likely they will remember it.

cons
- if too many passwords and lots of paper things can get messy
- typically a lock on a drawer used to secure the paper is easier to break than most techniques used to crack encrypted data

share|improve this question
1  
"paper won't break down like computers do" .. actually it might get destroyed. For example in a fire (even in a safe) –  Flo Jan 10 at 11:27
    
Backing up data should typically include your encrypted password safe too. As losing data on your machine might hurt you more than simply losing passwords. –  Samuel Jan 10 at 11:33
    
@Flo agreed but my point was that computers are suseptable to way more damaged than paper, for example viruses, settings getting corrupt etc. sure someone can burn or break a piece of paper but all that could be done to a computer hard drive as well. –  Celeritas Jan 10 at 21:53

2 Answers 2

The biggest advantage of a software password vault over writing it down on paper is that the data is encrypted with a secret that you store in your head. If the secret (password) is strong enough, it should be next to impossible for an attacker to break into it through bruteforce. The other benefits you list such as easy to search, organize, backup and distribute are just secondary benefits IMO.

Writing down the passwords on paper offer no such benefit. For it to be remotely usable, the paper has to be in your desk or wallet where it is relatively easy to get to. Sure, you can stick the paper in a physical safe and make it difficult to steal, but it's a hassle from a usability perspective.

Another major benefit of using a software password vault is that it almost entirely removes the risk of falling prey to a phishing attack. Most password vaults come with features that allow you to fill in the credentials automatically when you visit the correct website. This removes the possibility of a user being duped into entering the credentials into a phishing website by accident.

share|improve this answer

Storing password on paper has one more disadvantage: it is very unstructured.

Usually when people write down some password on paper they leave those papers in many different places, and they don't care about destroying old ones. This cause that after some time they are not able to tell, where their password are and who accessed them in the meanwhile.

So: if you would have some process of storing password on paper, which demands use of same safe place, and some other procedures, maybe it could be OK.

But no one does it.

Because KeePass and other similar tools are free, secure, convenient, simple in use and does not consume our time to configure and use.

share|improve this answer
    
Would not recommend TrueCrypt but rather KeePass or similar as handling passwords with TrueCrypt is more than annoying and unconvenient. –  Samuel Jan 10 at 13:27
    
@Samuel - Sure, you're right. I updated by answer, thanks! –  boleslaw.smialy Jan 10 at 14:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.