Schneier is telling me to write my bank security password and keep it in my wallet? Is that right?

Question

Bruce Schneier Writes Down Passwords. So Can You

...

But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security professional, he has a very easy-going view on passwords.

"I have some very secure passwords for things that matter -- like online banking", he says. "But then I use the same password for all sorts of sites that don't matter. People say you shouldn't use the same password. That is wrong.

And when people say don't write your password down. Nonsense. Write it down on a little piece of paper and keep it with all the other small bits of paper you value -- in your wallet."

He opens his wallet and pulls out a £20 note. "This has value. Your password has value. As a society we are good at valuing small bits of paper. We have cracked that problem."

https://www.schneier.com/news/archives/2010/11/bruce_schneier_write.html

I understand where this is coming from. It's very easy to find security "advice" that is impractically hard ("everyone should stop using Windows" :-P). Therefore it is necessary to engage in a little critical thinking. Otherwise, in practice you will end up skipping a more important security precaution because you are not working from the right priorities. Or suffer excessive costs in trade-off - possibly including loss of availability due to forgetting a password.

The problem is I am very literal. I am trying to think critically about how to safely remember the passwords for my multiple online bank accounts. A literal interpretation of the linked article is:

• Write the security password(s) for your online banking on a piece of paper, and put it in your wallet along with your debit card.

My critical thinking is extremely suspicious of this, because

1. My current account allows me to log in online using my debit card number.
2. I have been known to lose a wallet. Or two.

My current account T&C's say that you are liable for any fraud if you "didn’t take reasonable steps to keep your payment details safe". I suspect they would not be sympathetic to an argument that I was simply following the advice from a renowned security expert's web page :-).

It feels like an odd comparison. The expected contents of a wallet can indeed be valuable. But I'm not as worried about card theft, partly because it's secured by a short PIN. And one typically only carries a limited amount of cash, compared to the amount held in a bank account.

So. Where are the weak points in all of the above?

• Why did the high reputation security expert say this, and confirm it by reposting it on their own website, without further comment?
• Have I made a literal-level error in my interpretation?
• Is the literal interpretation actually not a bad idea, and if so why?
• Is there something particularly unusual about my own situation?
• Should I consider that the "News" tab of schneier.com (distinct from the "Blog" tab) cannot be trusted in the same way as the rest of the site? I.e. could this be Schneier re-posting a news article that favoured him, without reviewing the post for the implication of rather bad ideas?

Answer 1

I think it is bad advice. I want to break the answer down in two sections, namely using the same password on multiple sites as well as your original question about storing a password on a piece of paper in your wallet.

Thoughts about storing passwords on paper (and in your wallet)
As of today there are multiple good password managers which are better then the alternatives out there, such as writing a password down on paper. Troy Hunt actually made a really good blog post about this subject. In general it is considered a bad security practice to write down passwords, because of several risks involved:

• You can lose the paper with your password on it, this would mean you lose access to that password but also someone else might be able to use it depending on where you lose it;
• Someone might be able to use the password when he steals the piece of paper or when he can take a look at it, similar to shoulder surfing.

When you take into consideration people (including you as I can tell by your question) losing their wallet with both the password and banking details from a credit card or banking card, I would consider this a critical risk to your finance and personal data in general. A wallet is not made to secure money, it is meant as storage. The same principles should be applied to using it to secure your password.

Thoughts about using the same password on multiple sites
It is also not considered a good security practice to use the same password on multiple sites because of credential stuffing. Even if the sites are not important to you, the data the website has about you might be interesting to others. Combining personal data can also be very powerful for someone who wants to do harm to you.

I don't think Bruce Schneier means he uses the same password he uses on multiple sites for his banking account, because that would be outright ridiculous. I do however still think the above applies to 'non important websites'. You also have to take into consideration that Bruce Schneier is a security professional and is well aware of potential risks in certain services. People who are not so aware might not consider their email an important service for example, yet it most of the time holds the access to a lot of other websites because of the Forgot your password feature on a lot of websites.

The same applies to storing your password on paper. Bruce Schneier is a security professional and can take certain risks because he is aware of the potential damage and can actually make well informed choices. Writing passwords down on paper should be considered a bad security practice for most people, keeping the paper in your wallet included.

Therefor I do not agree with the advice for Bruce Schneier and to answer all of your questions:

Where are the weak points in all of the above?

I answered this in the details above here, both storing passwords on paper as using the same passwords should be considered weak points.

Why did the high reputation security expert say this, and confirm it by reposting it on their own website, without further comment?

Because not everyone has the same opinion, clearly he has a different believe when it comes to passwords. That is alright, as long as we all have the debate we're having on this question: What should be considered a good security practice today.

Have I made a literal-level error in my interpretation?

I don't think you have.

Is the literal interpretation actually not a bad idea, and if so why?

Just as with password managers, if writing down your password on paper is a better (but not perfect) practice then not storing on paper, by all means, go ahead. For example, if the alternative is using a weak password on every single service including your banking account, writing a secure different password on paper and storing it in your wallet might actually be a good idea. However using a password manager would be even better.

Is there something particularly unusual about my own situation?

No, I lose my wallet all the time and being a critical thinker, especially when it comes down to security, is a good habit.

Should I consider that the "News" tab of schneier.com (distinct from the "Blog" tab) cannot be trusted in the same way as the rest of the site? I.e. could this be Schneier re-posting a news article that favoured him, without reviewing the post for the implication of rather bad ideas?

I don't think you should necessarily, but that of course is up to you. Bruce Schneier also has good advice and he is still well known and widely respected. Re-posts on a website like this should be more trustworthy then some other sources, but always, like you did now, be criticizing articles to see if it is trustworthy. So yes, this could have been a re-post without reviewing the implications, although I do believe this is not just your job: It is the job of the re-poster, in this case Bruce Schneier.

Answer 2

Should I keep my password/s on a piece of paper in my wallet.

Probably not a big deal. With hardcopy password storage, access is the major issue. So, if it's in your wallet it is presumably in your presence or in a safe location at all times. If so, the security risk of someone stealing your password is pretty equivalent to someone assaulting you for your password, so I'd say it's fine. That might sound like a strange thing to say, but it's an old and known maxim in Security that someone can just break kneecaps with a 20 dollar baseball bat for a password instead of 60k in cloud compute.

Keeping your password on a slip of paper -not- in your wallet -can- be a bad idea. If it's in a safe, great. If it's on the underside of your keyboard at work, very very bad. Old Sec Pro trick is to bet you can get a password for an office in under 5 minutes and then start flipping keyboards. Almost always works. So use common sense with hard copied passwords.

Extra bonus item:

"I have some very secure passwords for things that matter -- like online banking", he says. "But then I use the same password for all sorts of sites that don't matter. People say you shouldn't use the same password. That is wrong."

EDIT: the wording is confusing. This is if the above means that he uses the same password for banking as for all sorts of sites that don't matter. If he is saying he uses one password for banking, and another for non-sense sites that would make much more sense and the below can be ignored. Leaving in to clarify confusion.

This is absolutely incorrect advice. I don't know enough about this person to guess at where this came from, but as a Sec Pro working in "the wild" I can confirm that this is just wrong. One of the major forms of attacks out there is taking stolen creds from a breached website and trying them across multiple other website (like banking). Please do not take this advice. Please use discrete passwords for every "important" account you have. If you want to share creds on accounts with no credit card or other sensitive data, fine, but don't use same password for your bank everywhere. There are years of examples of why this will get you "hacked."

Answer 3

The discussion has suggested several points to focus on.

As I say, the article advocates for critical thinking. At least one other user also had a double-take, as to whether the advice about using a physical password wallet was really meant to apply to online banking :-). For this specific type of risk, it might be more appropriate to ensure one higher level of security.

I can think of one mitigation that applies to me. Before I can transfer money to a new payee, my bank requires that I prove ownership of my debit card, and that I know its PIN, using a standalone card reader, and I receive a text message alert. This card reader was not part of online banking originally, but I believe it is now prevalent in the UK. Although there are various stories about attacks on the "chip and PIN" system, I believe that system is doing a reasonable job overall. I believe it is not a legacy system that should be considered broken for all time, like GSM is. I feel very pleased that I have this security feature, but I have seen no authoritative advice that I should rely on it to this extent.

The main point raised is that it is relatively unusual for most people to lose a wallet.

I was a bit surprised to see that as a possible explanation. The loss of a wallet feels relatively bounded to me - it could be extremely inconvenient, but we have systems to handle it. But if it includes my online bank login and password that feels like the loss could be several orders of magnitude higher. I'm not sure if the equivalence here makes sense.

Secondly, theft and robbery does happen (and you can look at the statistics on it - which I would be happy stipulate will give you a higher probability than accidental loss). My understanding was that part of the "solved problem" here is things like not carrying excessive amounts of cash, and anti-theft measures on expensive mobile phones.

Lastly, some people are surprised to think that your physical wallet would also include both the exact username and site name that you need to be able to log in. So the idea of logging in with a card number does seem to be a less obvious one. Possibly this feature was less common in 2010 (or is still uncommon now?).