Password managers check the URL before giving its data. A human being can be fooled into giving it to a fake web site.

Yeah, It's actually quite a secure way to store passwords, since it requires physical access.

I knew a guy who had a drawer full of slips of paper with passwords written on. He called it the "security drawer". Made me smile, but probably shouldn't have been advertising it.

Just maybe don't plaster "THESE ARE MY SECRETS" on the cover. Security through obscurity.

Please hold your password notebook in front of the laptop camera.

but:

1. way less convenient to generate dozens and dozens of unique, complex passwords. which means it’s less likely to be used/updated as much as it should be.

2. not tied into MFA which is an additional layer of security and convenience

Their Ring camera that points directly at the desk they keep this notebook on: "it's showtime"

As long as the notebook is in a locked draw I would pass this on an IT Audit.

And very power efficient

Quantum proof

Just as the Lord intended.

The main weakness

is it's a pain in the ass.

• Won't generate strong passwords.
• Won't fill out login forms for me.
• Manual, slower search and copying (worse for dyslexia).
• Increases risk of submitting credentials to wrong site/app (especially malicious ones).
• Increases error of mistyping credentials.
• More effort to back up & retrieve.

Yep. My Dad in his late 70s uses this system and it works great for him.

People make fun of it, but for people with low tech literacy this is actually far better than having a mish-mash of solutions where some their logins end up automatically saved in iOS on their phone, some are saved in Chrome on the desktop, some are just in their head, they don't know where anything is, and are constantly losing access and resetting credentials all the time.

And it definitely reduces the burden on me of parental tech support, when its all in the book.

My Mum died recently and my step dad is shit with tech, so their password book was invaluable in helping us gain access to her Apple account and her phone. It meant we were able to get to her iCloud passwords, so now we have access to everything.

So yeah, password books are actually pretty handy.

“People can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and then write it down.

We're all good at securing small pieces of paper. I recommend that people write their valuable passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet.

Obscure it somehow if you want added security: write "bank" instead of the URL of your bank, transpose some of the characters, leave off your userid. This will give you a little bit of time if you lose your wallet and have to change your passwords. But even if you don't do any of this, writing down your impossible-to-memorize password is more secure than making your password easy to memorize.”

Bruce Schneier - 2005.

Don't forget to use diceware. The human mind is not random enough https://www.eff.org/dice

For the majority of my clients who use this kind of system, it is totally dysfunctional.

Most of the records are incorrect, my guess is that they occasionally reset the password on mobile while the book is inaccessible and then don’t remember to update it in the book later.

Effective use relies on the user’s understanding of umbrella accounts. I’ve had users have separate written entries for “Office”, “Skype”, “Hotmail”, and “Windows” because they don’t understand those things are all one Microsoft Account.

As passwords get updated, it can become a mess of crossed out records with new ones squished into the margins. When a someone dies, anything written illegibly can be difficult for surviving family to discern. As the book gets filled out, it can get tricky to keep things alphabetized unless the user provisioned additional empty space between records.

This system can work great for someone who is meticulous, neat, and organized.

For your average person, I’ve had better luck solving the problem with a password manager synced to an online account that is protected by MFA and has recovery options that are also protected by MFA.

What this book likely doesn't suggest, is to just code the username.

I have 2FA backup codes in my go bag and nowhere do I write the usernames or even the service if it's important.

You know your email address. If you lose this in an airport, writing "main email" makes it useless to anyone else.

The main weakness it has is from a nosey flatmate, spouse, or child in the house.

Watch out for that home grown script kiddie

I'm going back to paper for most things and I don't know man, I think it's more user friendly given the current tech landscape. My paper notebook never changed the interface to add a huge Copilot button.

It is very user friendly, at least for reliability and security if you keep it in a safe location. It is cumbersome and slow.

Silly, you just posted a picture of your key now everyone can access your passwords

InfoSec likes nothing more than for you to tell them not to worry because you write all your passwords down and only read emails after you've printed them. 100% secure.

In my office I have a list that says passwords all nonsens and just as a decoy. I have a system that I use for rotation woth a visual reminder (by association, not directly) somwhere in my office

I have hundreds of logins, the convenience of a password manager is just too nice.

Or for folks that would be otherwise leaving logins and passwords in a clear text file on their desktop (glares at coworker). It's still clear text, but at least it's air gapped. It's not for me, but it's certainly for someone.

Exactly this is the reason why I gifted it to someone. I'm already glad they don't use 1 password for every website.

* for the tech inclined

Managing sync between mobile and desktop is a bit more complicated than average consumers have the patience for (it’s really not very complicated, average consumers are just impatient)

i got bitwarden

For a lot of people at 60+, writing things down is easier and safer. It will also help anyone that would need to troubleshoot or in the event of death in a very simple way.

As a software engineer who values humanity has done a good bit of work with "the cloud", i think your dad has the right set of feelings towards the cloud. That fucking cloud can go get bent

Especially when helping your parents living in the middle of nowhere.

Seeing them struggle with the changes happening in the last few decades, makes me worry what I'll be like when i need some young whippersnapper so that I can pay via personal, irrational, conditional thinking.

It's infuriating! 😬

they just centered the whole thing 🤦

My password-manager is a script that gpg-decrypts to XDG_RUNTIME_DIR and then opens it in editor, encrypts back on changes. Is that bad?

I have a letter in my safe in the event of my death that contains all my passwords and accounts. I have also slipped in a dead man switch that she's unaware of that will wipe out my "collection of science".

Or Microsoft who randomly needs to verify someone's identity before they can log into.tgeir computer but the user doesn't have a smart phone. So they need to call someone trusted to have them log into their email from a different computer just to get the code so the user can log into their computer.

But that also means they didn't have access to any saved passwords so a notebook helps.

I really should put Linux on her machine but then I have to show her how to do that too. It's a lose-lose so I keep it the same.

I miss local accounts.

That's how they get you, i put mine in a DONTREADME.txt file.