166

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers blocked) Complex format (differing cases, special characters, etc.) If so, you are actively incentivizing people to write the password down. Drop the outdated ...


140

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And even if you did have access to all their devices, you can only check that they haven't written down the password if you, as a sysadmin, yourself know the password....


20

Install a camera behind their desk, better yet multiple cameras to cover all angles, and have somebody watch them. You might be bothered by this being unethical but don't worry, it's in no way worse than almost any other way that achieves what you want to do. About that almost: Use "passwords" that cannot be reasonably represented in plaintext by a user. ...


19

You don't. By forbidding users to write down their passwords, you're forbidding them to use the second-best password manager in existence. People are generally quite good at protecting the contents of their wallets; a list of complex passwords written on a piece of paper stored between their driver's license and their credit card is about as secure as you ...


16

What is your threat model? I know I ask that counter-question to almost everything here, but most question about security never state what they actually try to secure against. Are unauthorized people regularily in your environment and could spot passwords that are written down? If so, awareness in your users can be improved to this specific and easily ...


13

First off, I agree with the answers that say that this is a bad idea for a variety of reasons. Second, it appears that you are trying to use technology to solve a human problem. It is very, very rare for that to end well. Instead of focusing on technical measures to prevent writing passwords down, such as cameras, non-pasteable password fields, and so on, ...


1

I realise I am late to party, but.... How can I ensure that they haven't done so by writing their password in emails, scripts, documents or files You Can't. Not practically. Passwords are a single layer authorisation mechanism. If you care about passwords being "written" or recorded then you need to: Quantify the risk factor and mitigate these risk ...


1

As everyone has said, you don't. You should consider whether passwords (single-factor authentication) are adequate for your needs. Even if all your users abive by password guidelines, there are other risks such as shoulder-surfers and key-loggers. A much better solution is two-factor authentication. There are various dongles that you can buy, or there's ...


Only top voted, non community-wiki answers of a minimum length are eligible