7

I have seen a lot of discussion online surrounding whether using password management software is more secure than writing your passwords down on paper and vice versa. However, a lot of this discussion assumes that the user is simply writing down the usernames and passwords in complete plaintext.

How much safer, if at all, is a password manager than paper assuming you obfuscate them in some way? I am slightly skeptical of putting all of my passwords into a piece of software and having that single point of failure that can be accessed through the internet.

  • 2
    Are you running AES 256 or similar by hand on your written down passwords? ;) – Xiong Chiamiov Dec 7 '17 at 17:53
  • Interesting question! To make the question less broad (to broad questions may be closed), I took the liberty to edit out the bonus question. If you disagree with that, you can off course do a rollback to put it back in. But I would recommend you to ask a separate question instead. – Anders Dec 7 '17 at 21:54
4

There isn't a clean answer to this. It depends on the user. Just a handful of immediate considerations (there are many many more) -

  • How is the physical book stored? I.e. someone keeping a book in a physical safe in a gated home is a lot safer than the guy carrying around the book saying "passwords" on the front of it in his rucksack.
  • How secure is the machine the password manager is used on? If untrusted code is running on that machine as the same user theoretically there is nothing stopping it reading the passwords.
  • Not all password managers are internet based. You can either just store them locally or use a hardware device.
  • What passwords are used? Someone using a password manager is a lot more likely to user longer randomly generated passwords than someone copying them out of a book.
  • What does the password protect? I.e. your password being written down in the same physical location as an a machine with an unencrypted disk doesn't really reduce the security from a vaguely technical opponent. Writing the password to an encrypted USB stick on the stick makes it pointless.

Both techniques when used properly can be very secure. With a password manager you gain the ability to additionally have a master password which isn't recorded anywhere. With a password book you gain security from cases where you need to enter a single password on an untrusted machine.

  • Great response thanks for getting back to me! 1. The book would be stored in a secret location within a property that only those I trust have access to. 2. I would only ever sign into the password manager on machines that I personally own and that no-one else uses. I am very careful about this already. 3. That's a very good point, I may take a look at KeePassX. 4. I was either thinking of generating them myself following good password guidelines or writing down ones generated by a service like LastPass. 5. Only online accounts, all of my passwords for local are stored elsewhere. – Luke Glazebrook Dec 7 '17 at 16:52
  • @LukeGlazebrook - I would suggest >12 character fully random alphanumeric passwords should be more than secure unless you view yourself a high risk individual. A hardware device (either a dedicated device or an old smartphone with all networking disabled and a non-internet based password manager installed) makes a good hybrid between the two methods. – Hector Dec 7 '17 at 16:56
  • That could be feasible yes and I could even back up the PW database on to some USB sticks just in case the dedicated hardware breaks. I can definitely see the advantages of a password manager like 1Password but I think Keepass is more my style. Thank you for all of your help! – Luke Glazebrook Dec 7 '17 at 16:59
1

One can actually do a combination of both. Buy/use a cheap, ev. old or second-hand android smart phone - it doesn't have to be performing. Wipe it clean. I would personally install lineage-os on it without the google suite. Encrypt the device with a hard pass phrase. Disable all networking (air plane mode). Store your passphrase book in a text file in there, and only use it for that. Consider it your electronic version of your passphrase book. Eventually, you buy two of them, to have a back up ; or you can make an encrypted nandroid copy on a USB stick which you put in a safe. Never connect the device to a network, always keep it in air plane mode. It's a way to give a second life to an older smart phone: as an encrypted notebook.

1

It depends how much paranoid you are. There are few levels of paranoia regarding privacy.

  • Tier 3: You think you are smart enough and nobody go through your personal encrypted notes where you written your passphrase by using some of your own invented encryption method. Then you should use passphrase book.

  • Tier 2: You think may be someone will find your note book or you may loose it (as you have to bring everywhere) then you could use password manager. If you don't like closed source you may use open source password manager like Keepass or Lesspass. I would recommend this for everyone.

  • Tier 1: You don't trust anyone except your good old memory. You memorize them all without compromising randomness. I would love to explain here how to organize, memorize your passphrase without compromising randomness but that is irrelevant here.

For your information: I have used the word passphrase in each case of the word password. I believe we all should do the same.

  • Does your numbering imply a Tier 1 paranoid tries to hide their classification? – user123931 Dec 7 '17 at 20:42
  • I think it is Keepass, no ? – entrop-x Dec 7 '17 at 21:24
  • 1
    Nice joke dirt! @entrop-x, you could edit my answer to correct those, you would have got +2. – Muhammad Dec 8 '17 at 11:13
  • @Muhammad - "by using some of your own invented encryption method" - you've just broken the golden rule. Never roll your own! – Hector Dec 12 '17 at 9:04
  • Yah I know. That's why it should everyone's last choice. But the question is about password manager and password book. And I don't think there is any fastest way to decrypt handwritten information without self-made encryption or any other method. – Muhammad Dec 12 '17 at 9:10
0

I cannot give a definitive answer to this question because it depends on a lot of things. So I will just give some remarks:

I am slightly skeptical of putting all of my passwords into a piece of software and having that single point of failure that can be accessed through the internet.

So I am! My password vault exists in 2 places: on my desktop and on my smartphone and it is never copied on a cloud folder: it is not a single point and only a previous successful attack could make it accessible through internet. What I mean here is that I use 2 defense lines: the file is not publicly available and its data is protected with a password and a strong encryption

... is more secure than writing your passwords down on paper

Passwords on a paper is generally considered as a really secure solution if the paper is then stored on a physical safe. It is still common for secrets for which loss of availability would have serious consequences on an organization: only few people (ideally only one person) use the secret on normal use cases, but if that person dies or is seriously injured, a backup allows the organization to give the secret to someone else.

... assuming you obfuscate them in some way?

Obfuscation is generally frowned upon when security is researched. You have not explained how you want to obfuscate so I cannot give an advice on it (nobody can). But you cannot do without revealing the secret, so you can only rely on your idea being original enough to prevent an attacker to guess it, whatever they can know about you. You are on your own at this point, but asking the question is a sign that you are not sure of it...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.