Reading an answer to another question ("Is there a method of generating site-specific passwords which can be executed in my own head?") I came across this link, describing a way to use a physical token (a tabula recta with randomly generated characters) to derive different passwords for different sites (choose a cell using the site name and some rule, follow another rule to get the chars that compose your password). I was curious about whether or not that would be a good practice.
The author claims to be an expert in computer security, and as far as I can tell his reasoning looks sound. He does make the caveat that "the security of this system rests on the randomness of the generated characters and the piece of paper." (emphasis mine) In other words, if an adversary gains access to your token, it's over, that I understand (it's easy to show that a dictionary attack can be performed with it*).
However, I'm having trouble determining whether or not the risk of losing the token combined with the consequences of this event would render this practice unfeasible, or whether those can be mitigated somehow. I believe the risk of forgetting a password (especially if not reused across sites, as it shouldn't) is far greater than of being (personally) targeted by a malicious adversary, and password managers are a bit awkward to use. I'd like to know about pros and cons of this technique, and maybe ways in which it can be improved/made feasible (preferably concerning the practical use, I believe the crypto aspect should be self-evident).
* To perform a dictionary attack, just take each cell of your token (unless you're using a really big piece of paper, there won't be over a few dozen or hundreds of cells) and follow any rule that a human can reasonably follow "by hand" (diagonals, spirals, knight jumps, etc). There shouldn't be many of them (let's be optimistic and say a hundred), and since there will be exactly 1 sequence of N characters starting from a single cell and following the same rule (regardless of N), that leaves no more than 100k possibilities to test for each N (weaker than a 4 character alphanumeric password, for the sake of comparison).