I am interested in knowing if/what 'solutions' exist for password management in cases where people do not want to use a password manager (for whatever reasons they may offer...)
- The person can remember one complete password.
- The person cannot write/store any actual password (of course!) - though 'triggers' can be written and stored.
- The person needs to remember 10-100 passwords (picked this range because it covers most cases).
Our goal is to ensure security while maximising convenience for the user.
To give an example, one might suggest having a "master password" (easy to remember, hard to crack, xkcd's post being a good starting point) and then a caesar cipher stored in multiple locations (online drive, phone note, piece of paper at home) for each login.
This is fine, but isn't fantastic for at least four reasons:
- The task of rotating is not particularly natural/simple for humans. With practice/frequency some would be easy for but non-everyday logins it would likely be cumbersome.
- The passwords are intrinsically linked so if one of the passwords is cracked the others only take 36 (assume we don't want to demand the user rotates more than lowercase letters and numbers) guesses at most to crack (this also assumes that the hacker can recognise that the passwords are constructed using a cipher technique which is unlikely so this isn't a huge problem, but also not totally unreasonable).
- Passwords become non-unique from 37th password onwards.
- Our cipher key information has a nasty trade-off. We have to store it multiple locations because losing it implies incredible inconvenience, but the more places we store the more chance there is of it being discovered (not critical because the master password is still needed to make it useful, but still a negative characteristic).
Does anyone know of any better/standard alternatives?
P.S. When I say 'non-software' I mean specifically password manager - you could of course write information in a text editor or use some programming language to rotate your master password, etc. if that forms part of your method.