Non-software individual password management solutions

Question

I am interested in knowing if/what 'solutions' exist for password management in cases where people do not want to use a password manager (for whatever reasons they may offer...)

Let's assume:

1. The person can remember one complete password.
2. The person cannot write/store any actual password (of course!) - though 'triggers' can be written and stored.
3. The person needs to remember 10-100 passwords (picked this range because it covers most cases).

Our goal is to ensure security while maximising convenience for the user.

To give an example, one might suggest having a "master password" (easy to remember, hard to crack, xkcd's post being a good starting point) and then a caesar cipher stored in multiple locations (online drive, phone note, piece of paper at home) for each login.

This is fine, but isn't fantastic for at least four reasons:

1. The task of rotating is not particularly natural/simple for humans. With practice/frequency some would be easy for but non-everyday logins it would likely be cumbersome.
2. The passwords are intrinsically linked so if one of the passwords is cracked the others only take 36 (assume we don't want to demand the user rotates more than lowercase letters[26] and numbers[10]) guesses at most to crack (this also assumes that the hacker can recognise that the passwords are constructed using a cipher technique which is unlikely so this isn't a huge problem, but also not totally unreasonable).
3. Passwords become non-unique from 37th password onwards.
4. Our cipher key information has a nasty trade-off. We have to store it multiple locations because losing it implies incredible inconvenience, but the more places we store the more chance there is of it being discovered (not critical because the master password is still needed to make it useful, but still a negative characteristic).

Does anyone know of any better/standard alternatives?

P.S. When I say 'non-software' I mean specifically password manager - you could of course write information in a text editor or use some programming language to rotate your master password, etc. if that forms part of your method.

Answer 1

Knowing and memorizing a credential pair for computer access is just a fact of life.

Same thing applies to the "real world". Imagine if all the owners of a Honda vehicle could just put their keys in any Honda and drive off. Wouldn't be a very good system would it?

Things you may want to look at:

• Something you have, a Smart Card/Token
• Something you are, biometics
• Somewhere you are, an assigned work station behind a keyed/locked door
• Single Sign On (SSO), seen with larger corporations or universities

Unless you intend to access public websites, smart cards are a perfect solution for an intranet.

This requires users to remember a PIN, but could store a single certificate or many for various logins. A numeric PIN is much easier to remember, and certificates are much stronger than a simple password.

Sharing credentials is uncommon, but seen in some corporations with temporary workers, sharing a crediential pair for use on a single system is acceptable. The reason for this is because they work on alternate work days, you can track who was in that day, and only 2 users are aware of the credentials. This is done on a system-by-system basis to simplify management.

As for writing passwords down and such, this is perfectly acceptable if you are unconcerned about a local attacker. Many are probably aware of their elderly family member(s) doing this. The concern is minimal because it's much more likely someone to attack their accounts from the web than locally in person.

Doing this in a corporation/enterprise however, under PCI compliance or HIPAA is likely to land you in some legal troubles or voided agreements at the minimum.

The other issue arises is that writing down credentials changes the game. Authentication, having a user prove their identity, no longer exists as anyone could walk up and enter the credentials. By having a written credentials turns things into authorization, proving a right to a resource.

Single Sign On allows the user to enter their credentials once, and access many other resources by sharing a secure token to said resources. This is not common in smaller enterprises due the shear work involved in setup/maintenance.