Password manager vs password book

Question

I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion assumes that the user is simply writing down the usernames and passwords in complete plaintext.

How much safer, if at all, is a password manager than paper assuming you obfuscate them in some way? I am slightly skeptical of putting all of my passwords into a piece of software and having that single point of failure that can be accessed through the internet.

Answer 1

There isn't a clean answer to this. It depends on the user. Just a handful of immediate considerations (there are many many more) -

• How is the physical book stored? I.e. someone keeping a book in a physical safe in a gated home is a lot safer than the guy carrying around the book saying "passwords" on the front of it in his rucksack.
• How secure is the machine the password manager is used on? If untrusted code is running on that machine as the same user theoretically there is nothing stopping it reading the passwords.
• Not all password managers are internet based. You can either just store them locally or use a hardware device.
• What passwords are used? Someone using a password manager is a lot more likely to user longer randomly generated passwords than someone copying them out of a book.
• What does the password protect? I.e. your password being written down in the same physical location as an a machine with an unencrypted disk doesn't really reduce the security from a vaguely technical opponent. Writing the password to an encrypted USB stick on the stick makes it pointless.

Both techniques when used properly can be very secure. With a password manager you gain the ability to additionally have a master password which isn't recorded anywhere. With a password book you gain security from cases where you need to enter a single password on an untrusted machine.

Answer 2

One can actually do a combination of both. Buy/use a cheap, ev. old or second-hand android smart phone - it doesn't have to be performing. Wipe it clean. I would personally install lineage-os on it without the google suite. Encrypt the device with a hard pass phrase. Disable all networking (air plane mode). Store your passphrase book in a text file in there, and only use it for that. Consider it your electronic version of your passphrase book. Eventually, you buy two of them, to have a back up ; or you can make an encrypted nandroid copy on a USB stick which you put in a safe. Never connect the device to a network, always keep it in air plane mode. It's a way to give a second life to an older smart phone: as an encrypted notebook.

Answer 3

It depends how much paranoid you are. There are few levels of paranoia regarding privacy.

• Tier 3: You think you are smart enough and nobody go through your personal encrypted notes where you written your passphrase by using some of your own invented encryption method. Then you should use passphrase book.

• Tier 2: You think may be someone will find your note book or you may loose it (as you have to bring everywhere) then you could use password manager. If you don't like closed source you may use open source password manager like Keepass or Lesspass. I would recommend this for everyone.

• Tier 1: You don't trust anyone except your good old memory. You memorize them all without compromising randomness. I would love to explain here how to organize, memorize your passphrase without compromising randomness but that is irrelevant here.

For your information: I have used the word passphrase in each case of the word password. I believe we all should do the same.

Answer 4

I cannot give a definitive answer to this question because it depends on a lot of things. So I will just give some remarks:

I am slightly skeptical of putting all of my passwords into a piece of software and having that single point of failure that can be accessed through the internet.

So I am! My password vault exists in 2 places: on my desktop and on my smartphone and it is never copied on a cloud folder: it is not a single point and only a previous successful attack could make it accessible through internet. What I mean here is that I use 2 defense lines: the file is not publicly available and its data is protected with a password and a strong encryption

... is more secure than writing your passwords down on paper

Passwords on a paper is generally considered as a really secure solution if the paper is then stored on a physical safe. It is still common for secrets for which loss of availability would have serious consequences on an organization: only few people (ideally only one person) use the secret on normal use cases, but if that person dies or is seriously injured, a backup allows the organization to give the secret to someone else.

... assuming you obfuscate them in some way?

Obfuscation is generally frowned upon when security is researched. You have not explained how you want to obfuscate so I cannot give an advice on it (nobody can). But you cannot do without revealing the secret, so you can only rely on your idea being original enough to prevent an attacker to guess it, whatever they can know about you. You are on your own at this point, but asking the question is a sign that you are not sure of it...