New answers tagged

1

I realise I am late to party, but.... How can I ensure that they haven't done so by writing their password in emails, scripts, documents or files You Can't. Not practically. Passwords are a single layer authorisation mechanism. If you care about passwords being "written" or recorded then you need to: Quantify the risk factor and mitigate these risk ...


1

As everyone has said, you don't. You should consider whether passwords (single-factor authentication) are adequate for your needs. Even if all your users abive by password guidelines, there are other risks such as shoulder-surfers and key-loggers. A much better solution is two-factor authentication. There are various dongles that you can buy, or there's ...


-1

Use certificates or device-based authentication. Yes, this doesn't answer your question straight, but provides a different approach to the problem. As pointed out by others, you can't enforce anything that will prevent a user to write their password down. So... my advice is to throw passwords. A certificate-based authentication system does not require ...


0

Make your passwords into non-textual ones. Like they can pick from a random set of images. Whatever is not easy to write down. Here is what Wikipedia has on it today: "Non-text-based passwords, such as graphical passwords or mouse-movement based passwords.[70] Graphical passwords are an alternative means of authentication for log-in intended to be ...


13

First off, I agree with the answers that say that this is a bad idea for a variety of reasons. Second, it appears that you are trying to use technology to solve a human problem. It is very, very rare for that to end well. Instead of focusing on technical measures to prevent writing passwords down, such as cameras, non-pasteable password fields, and so on, ...


16

What is your threat model? I know I ask that counter-question to almost everything here, but most question about security never state what they actually try to secure against. Are unauthorized people regularily in your environment and could spot passwords that are written down? If so, awareness in your users can be improved to this specific and easily ...


165

As others said, you can't stop them. But you can remove the incentive. Does your password policy require any of the following? Changing at regular intervals Manual entering (password managers blocked) Complex format (differing cases, special characters, etc.) If so, you are actively incentivizing people to write the password down. Drop the outdated ...


0

The typical way to enforce this is with a Clean Desk Policy. But I like your question; I think the solution can be brought to a ridiculous extreme :) It is common to enforce character groups, like lowercase, uppercase, etc. If you could set a reasonable minimum length, set a very low lockout threshold, and then enforce the inclusion of a character group "...


19

You don't. By forbidding users to write down their passwords, you're forbidding them to use the second-best password manager in existence. People are generally quite good at protecting the contents of their wallets; a list of complex passwords written on a piece of paper stored between their driver's license and their credit card is about as secure as you ...


-10

Already been answered, but let me give another idea. Instead of trying to enforce something unenforceable (even attempting would be such an invasion of privacy)... Why don't you just stop it at the source and require the user to type (not copy) the password into the field. Yes, it can be disabled by messing with the HTML/JS, but that takes knowledge and, ...


20

Install a camera behind their desk, better yet multiple cameras to cover all angles, and have somebody watch them. You might be bothered by this being unethical but don't worry, it's in no way worse than almost any other way that achieves what you want to do. About that almost: Use "passwords" that cannot be reasonably represented in plaintext by a user. ...


140

There is no way that you can be sure that a user hasn't written down their password. Even if you have complete access to their computer, what if they noted it down in their phone? Or on paper? And even if you did have access to all their devices, you can only check that they haven't written down the password if you, as a sysadmin, yourself know the password....


Top 50 recent answers are included