Virgin air-gapped devices and password management [closed]

Question

For password management:

"Practical" means it works in practice, and "secure" means protected against compromise and actually works. How do we get the highest P + S value?

I am convinced that all encryption keys for files, not just certification keys, should be generated by a TRNG, be stored offline in a virgin air-gapped device (you first heard it here: never touched the internet), and the passwords should be stored on the air-gapped device too. Forget trying to remember really good passwords because we cannot do it. For example:

-D('w'!\":4D$aC!)^x#82z-1&:=7c*$Ege^)x+_mQN0i:!*515i?zaf

or

]+"/!%.2&~395mgo2t~./y/82""V,b_+/57+a6d1R_*'^POc5732+#3,es0O,6uzJ<4.iyyp)VP'gz7

Now we have a physical security problem, and that is very good because it is a problem I can solve. The threat is not in my hometown, my neighborhood, etc., but rather on the big collection platform called the Internet. It is in Novosibirsk.

I am for writing all passwords down, but the trick is that what I write down is not my password and the method to figure out the real one is easy to remember. Huh? What I remember is what my passwords aren't, and I use a pepper (but no pepper with keys...). Substitution and transposition, Russian copulation, etc., whose value can be quantified and whose strength still depends on the key--all of which is relatively easy to remember. And then I change the method once in a while. I don't mind writing my pseudo-passwords on a little piece of paper to be stored in my wallet.

What ends up happening is that I do a lot of pecking at the keyboard, true, but one should, and I get to use really tough passwords--either for use on an air-gapped system or not-- that employ all 94 characters, are truly random, and can change often. And I skip password managers, which I regard as dangerous. So many exist, and so many have failed.

Is writing down passwords in a clever way the best solution to the password problem? Passwords should be truly random and long, but very few people get it right--and this astonishes me. Even worse, they are often told to use a password manager, which obviously increases their risk, sometimes profoundly. We have ample evidence that bad password managers can cause a security nightmare--it can be a single point of failure, and that is why they are such juicy targets.

Edit: What I have pointed out is that passwords which are very strong are very difficult to remember. Therefore, does it not make sense to write them down? If we write them down, then we might find it much easier to remember what that written text isn't, rather than what it is. By the way, Bruce Schneier used to encourage people to write down their passwords.

Is the best security solution to write down passwords, and to do it in a manner such that the password is insoluble to others?

Thank you.

Answer 1

What is best depends on your threat model. What works for you may be reckless or overboard to the next person.

Sometimes an air-gapped virgin computer is not enough, maybe the OEM got hardware backdoors installed. Sometimes you could use a internet-facing computer to generate a key, even making use of the impredictability of internet traffic as an entropy source.

I recommend using a password manager and don't being too paranoid about it. Password managers are good enough for the vast majority of users (you included), and typing a long and complicated password every time gets tiresome very, very soon. You must be really disciplined to create long, unique passwords and type them out every time, for a long time. Keeping that password-sheet adds complexity, as you need to keep more than one, or losing one means getting locked out of every single account.

Don't distrust password managers, they are good for you. They are secure, they create really random long passwords, they can protect you against phishing, as they will only auto-complete on the real domains, not look-alike domains.