I work at a library where I teach computer literacy classes, especially for the elderly. Among other things, we have classes where people set up e-mail or other online accounts. For many of them, this is their first exposure to passwords. About once a month, I'll have a conversation like this:
Patron: Can you show me how to do e-mail again?
Me: Sure. First, go to the e-mail provider's website. Good. Now type in your e-mail address and password.
Patron: I don't remember my password. I didn't think I would have to remember it.
Me: Your password is important. It lets the e-mail provider know that you are who you say you are and not someone else. Fortunately, we can try to reset it. Click that link there. It's asking security questions that only you would know. Looks like it's asking what your favorite book is.
Patron: I have no idea.
Me: Well, let's have you put in a couple of guesses.
Patron: None of these are working. Can we call Google and ask them to help?
I've had several patrons locked out of their accounts permanently because of this. I've tried having them write down their passwords. Not good security practice, and quite often they lose it (or worse, can't read what they wrote). They've tried to get me to remember their passwords for them, but as a library worker, it would be inappropriate for me (and that has all the problems of asking family members to keep your passwords). Yet nothing seems to help with having them remember their password.
Regarding security questions, I've instructed them to choose security questions that won't change. So don't choose "what's your favorite food?" but instead choose "where did you meet your spouse?" A few months ago, I actually had someone forget that too! They couldn't remember if they put the city, the name of the restaurant, or whatnot, and they never figured it out.
I had one patron who independently decided to put their e-mail password on a post-it note on their computer. I felt like screaming inside because that's an egregious security issue, but at the same time I was overjoyed that they didn't forget it any more. I didn't know if I should say anything about it.
So for users who chronically forget their passwords and security answers, what can I do to help them remember, yet still follow good security practices?