Bruce Schneier Writes Down Passwords. So Can You
But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security professional, he has a very easy-going view on passwords.
"I have some very secure passwords for things that matter -- like online banking", he says. "But then I use the same password for all sorts of sites that don't matter. People say you shouldn't use the same password. That is wrong.
And when people say don't write your password down. Nonsense. Write it down on a little piece of paper and keep it with all the other small bits of paper you value -- in your wallet."
He opens his wallet and pulls out a £20 note. "This has value. Your password has value. As a society we are good at valuing small bits of paper. We have cracked that problem."
I understand where this is coming from. It's very easy to find security "advice" that is impractically hard ("everyone should stop using Windows" :-P). Therefore it is necessary to engage in a little critical thinking. Otherwise, in practice you will end up skipping a more important security precaution because you are not working from the right priorities. Or suffer excessive costs in trade-off - possibly including loss of availability due to forgetting a password.
The problem is I am very literal. I am trying to think critically about how to safely remember the passwords for my multiple online bank accounts. A literal interpretation of the linked article is:
- Write the security password(s) for your online banking on a piece of paper, and put it in your wallet along with your debit card.
My critical thinking is extremely suspicious of this, because
- My current account allows me to log in online using my debit card number.
- I have been known to lose a wallet. Or two.
My current account T&C's say that you are liable for any fraud if you "didn’t take reasonable steps to keep your payment details safe". I suspect they would not be sympathetic to an argument that I was simply following the advice from a renowned security expert's web page :-).
It feels like an odd comparison. The expected contents of a wallet can indeed be valuable. But I'm not as worried about card theft, partly because it's secured by a short PIN. And one typically only carries a limited amount of cash, compared to the amount held in a bank account.
So. Where are the weak points in all of the above?
- Why did the high reputation security expert say this, and confirm it by reposting it on their own website, without further comment?
- Have I made a literal-level error in my interpretation?
- Is the literal interpretation actually not a bad idea, and if so why?
- Is there something particularly unusual about my own situation?
- Should I consider that the "News" tab of schneier.com (distinct from the "Blog" tab) cannot be trusted in the same way as the rest of the site? I.e. could this be Schneier re-posting a news article that favoured him, without reviewing the post for the implication of rather bad ideas?