Out-Law / Your Daily Need-To-Know
Security guru Bruce Schneier has backed calls from Microsoft's Jesper Johansson urging users to write down their passwords. In years gone by scribbling down passwords on Post-It notes was often cited as a top security mistake but the sheer volume of passwords people are obliged to remember means people often use easily-guessed login details, another security faux-pas. Schneier well known for his original thinking and ability to apply common sense to security issues advocates a low-tech solution to the password conundrum.
By John Leyden for The Register
This article has been reproduced from The Register, with permission.
"People can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and then write it down," Schneier writes in his latest Cryptogram newsletter.
Using a password database (such as his own free PasswordSafe utility) is one option. But Schneier is also enthusiastic about a much more low-tech approach - think of difficult-to-guess passwords, write them down and keep them on a bit of paper in your wallet.
"We're all good at securing small pieces of paper. I recommend that people write their valuable passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet," he writes.
The technique could be modified for a little extra security. "Obscure it somehow if you want added security: write "bank" instead of the URL of your bank, transpose some of the characters, leave off your userid. This will give you a little bit of time if you lose your wallet and have to change your passwords. But even if you don't do any of this, writing down your impossible-to-memorize password is more secure than making your password easy to memorize," he concludes.
