90

Answers to the question "How safe are password managers like LastPass?" suggest that storing personal passwords on a physical notebook might be a reasonable option:

I know someone who won't use Password Safe and instead has a physical notebook with his passwords in obfuscated form. This notebook is obviously much safer against malware... whether it's at greater risk of loss/theft is an interesting question.

Obviously, a piece of paper is secure against any malware attacks.

The requirement is for an offline access of credentials. For example a small notebook on which you write all your security details for all banks, stores, websites, even combination locks, addresses and all other details you may wish to be able to access from any location in the world.

Also, it can sometimes be easier to look up passwords in a notebook -- e.g. if you travel a lot, you could store passwords on your smartphone using a password manager app. However, this means your phone needs to be charged and operational all the time, which adds another point of failure.

Now, disregarding the posibilities that a notebook might be lost, stolen completely, destroyed or otherwise physically harmed, I'd like to focus on a one question:

How would you obfuscate (as mentioned in the first quote) passwords so that they cannot easily be deciphered by someone who is able to throw a glance at the notebook?

On the other hand, the algorithm must be simple enough so that the owner of the notebook can decode his or her own passwords in almost no time.

Bonus questions:

Could such an algorithm be considered more or less secure even if it's posted here on Information Security or does obfuscation always imply security through obscurity (i.e. keeping the algorithm itself secret)?

Could an obfuscation algorithm be designed in such a way that it would be impossible or unlikely to decipher the passwords, even if a hypothetical attacker had access to the notebook for at least several hours? Or would that naturally contradict the requirement that the owner can decode his/her passwords quickly?

Community
  • 1
tmh
  • 1,139
  • 1
  • 9
  • 10
  • 1
    "*Disregarding the posibilities that a notebook might be lost, stolen completely, destroyed or otherwise physically harmed*" -- because we're assuming reasonable precautions I assume? – Chris H Dec 22 '15 at 14:00
  • @ChrisH That, and I wanted to avoid the question being considered too broad. Feel free to mention aspects of physical security in your answer, though. – tmh Dec 22 '15 at 14:04
  • 71
    *How do you obfuscate passwords?* Simple. You write Dinosaur Erotica, and hide the passwords in the middle. You assume people would be too embarrassed to read it. – Shantnu Dec 22 '15 at 16:10
  • @Shantnu This is funny, but actually a valid answer. You can hide passwords in any text. Like Chris put it: "Put *too much* information in the book" The question is, how would you hide more complex (with numbers and special chars) inside an ordinary text? – tmh Dec 22 '15 at 16:13
  • 2
    Another approach would be to take an existing text, print it out and decided that for example the first letter of the first ten words in each paragraph make up a password... then leave some clues as to what account a paragraph belongs to... – tmh Dec 22 '15 at 16:14
  • Caesar cipher with an alphabet of A-Z, 0-9, ca[capitalization in the ciphertext and special characters unenciphered. Yes, there are only 36 possible keys and a password could be brute-forced in a few minutes. Often (usually?) an account will be locked for too many tries before a brute force attack succeeds. Also, a brute force attack is only possible if the notebook is compromised, which is (mostly) ruled out by the question. – Bob Brown Dec 22 '15 at 17:38
  • 1
    At least to prevent the passing glance, there's always [Leonardo writing](http://legacy.mos.org/sln/Leonardo/LeonardoRighttoLeft.html) – Wayne Werner Dec 22 '15 at 18:58
  • @BobBrown “Often (usually?) an account will be locked for too many tries before a brute force attack succeeds.” — That's what offline attacks are for. – Blacklight Shining Dec 22 '15 at 20:31
  • 8
    You can obfuscate and Caesar-cipher all you want, but if anyone manages to snap a picture of a page of your notebook and take it home, it's game over. There are two ways to secure data at rest: strong physical-access restrictions, and strong cryptography. You can't have the former if you want quick and easy access to the notebook, and you can't have the latter if you want quick and non-computerized derivation of the plain passwords. – Blacklight Shining Dec 22 '15 at 20:45
  • 1
    @BlacklightShining An offline attack implies that the target system's password hashes have been compromised. A) Your security is probably toast in that case anyway, and B) only a state actor (*cough* NSA *cough*) is likely to compromise both the password hashes *and* the little black book. – Bob Brown Dec 22 '15 at 21:20
  • 2
    @Dave plays have a rhythm, logic, cues from the other actors etc. to prompt memory. One of the skills actors need is the ability to memorise lines, which in many cases takes training. Of the plausible password advice the closest to learning lines is memorising a random sequence of words. An actor (or better an opera singer who can don't in a language they don't know) could probably do it. But not at the first attempt so they'd need to write it temporarily. The rest of us, not so much. – Chris H Dec 23 '15 at 08:10
  • @BobBrown That's assuming that the people running the target system are actually competent—if they're not, you end up with lists of hashes (and possibly email addresses, too) floating around. – Blacklight Shining Dec 23 '15 at 08:13
  • I suggest that if someone knew you and had access to steal the book, putting it through a shredder would be an effective DOS attack. A bag-snatcher or mugger would have the same effect. But then how do you secure any backup given that you need decent physical security on the book, with loss-detection. – Chris H Dec 23 '15 at 08:14
  • 2
    I have the advantage of having a relatively obscure native language, and on top of that I know and old script for it which fell out of use during the Middle Ages, and is known by significantly less than 1% of native speakers. So unless someone shares the same heritage *and* is a huge history nerd, they won't even recognize what the script and language are. Of course, if it was a targeted attack (if I was a celebrity, or an important CEO or political leader) they would figure it out, but otherwise it's a great solution against losing the notebook and especially casual glances by random people. – vsz Dec 23 '15 at 08:24
  • 2
    So use the lines of the play as your password, rather than (not) memorizing random text that lacks rythem. – JDługosz Dec 23 '15 at 13:23
  • 5
    for many years (before password safes), I used to put them smack in the middle of my phone list, like 'Tom G.: 321-555-1234', where Tom G. is the hint and the phone number is the password. Who except of you knows that you don't know anybody named Tom? Even after I tell you the concept, you will never know which of my 200 phone numbers are passwords and which are real people. - This is a bit outdated, I know; but maybe the idea can be enhanced. – Aganju Dec 24 '15 at 02:02
  • 1
    "*a piece of paper is secure against any malware attacks*" - you don't happen to have a webcam connected to your computer? – Bergi Dec 24 '15 at 12:14
  • 3
    "this means your phone needs to be charged and operational all the time" How would you use your password if you don't have your trusted device with you anyway? Use a virus laden public computer? Borrow someone else's untrustworthy phone? – Lie Ryan Dec 24 '15 at 13:29
  • Lousy handwriting anyone? – Luke Dec 25 '15 at 17:17
  • @Bergi Not sure I understand what you are saying. Are you suggesting malware with a social engineering component? – Michael Dec 26 '15 at 18:07
  • @Michael: No, I meant an attacker being able to take a look at the paper when it's lying around in the vicinity of the camera. – Bergi Dec 26 '15 at 22:44
  • My tactic would be to attach an unrelated unique code word to a password I create i.e. password: p4ssw0rd, codeword: doorhandle. Then you write the codeword as a hint of sorts, then commit the two to memory. No one will ever be able to guess or decrypt your password that way. Of course this approach is useless if you have a bad memory, which is probably why you're writing down the password in the first place! – Bamboo Dec 27 '15 at 04:40
  • Another option would be to print some source code or use an existing book that has source code listings, and derive passwords from the listings in a certain way. This way, you'll get some non-alphanumeric characters for free. :) Also, this is pretty unsuspicious if you're surfing around websites like StackOverflow all the time... – tmh Dec 27 '15 at 07:34
  • Something that gets thru my head: You could buy a really cheap smartphone, install Password Managing software on it from a secure location and then just never let it connect with anything except power cable to wall socket. Computers are much faster at en- or decrypting things than any paper based systems. – BlueWizard Jan 03 '16 at 06:04
  • The recent edition of c't, a German computer user magazine, also suggests backing up passwords on paper: http://www.ct.de/1418092 – tmh Jan 06 '16 at 11:59

15 Answers15

51

In approximate order of increasing complexity (not security, and methods may be combined), here are some ideas that would be easy for anyone used to puzzles/writing code/maths. A more complete idea is below. NB: when I say "secret" I mean not written in the book. These are all easy, and most useful to deter the casual thief.

  • Have a memorised secret element, common to all passwords. *
  • Minor variant -- an secret element easily derived from the website name/username.
  • Put too much information in the book, e.g. know that actually you omit the first 4 characters of each password.*
  • Offset the account and password by some constant number of entries. *
  • Never write the full username, just enough to be a clue to you.

* These items have the significant vulnerability that once the obfuscation is cracked for one entry, it's automatically cracked for all entries with no further effort.

If the exact algorithm is published, clearly a notebook-thief who could also script login attempts (or a team of course) could apply the algorithm automagically -- or all published algorithms. The type of algorithm could be published, for example:

  • From the password as written, call the first digit x and the second y.
  • Count x characters from the first punctuation mark (or first character, or first digit).
  • Then swap the cases of the next y letters (or preceeding y) letters.
  • For a memorised 4-digit PIN, increment the first four letters by the numbers of the pin (e.g. 1234 applied to a!bcd would give b!dfh).

Of course you could:

  • Swap the meanings of x and y
  • Increment/decrement x and y.
  • Count from the first vowel.
  • Swap the cases of y consonants.
  • Replace digits with their corresponding letters by alphabetic position and vice versa.
  • Swap digits for the punctuation on the same key (you either need to be confident in the keyboard layout you'll encounter or know your own keyboard very well.)

All these operations, by definition, can be scripted. But the notebook thief would have to get hold of (or write) a script implementing these (and it's actually quite a variable space even without a secret element. Then they'd have to type in the passwords (an error-prone process with randomly-generated text), run the script over the list, and attempt to log in with the now potentially thousands of passwords per site. And hope that the site doesn't lock out after several failed attempts.

It would be worth keeping a backup list, even if not a backup copy of the book, as a list of sites for which the passwords should be changed/accounts flagged if the book went missing.

As with many security measures, the goal must be to make it too much effort to break in. By combining manual and scripted effort you're doing quite a lot towards that, and increasing your chances that they'll give up.

Chris H
  • 4,185
  • 1
  • 16
  • 22
  • 5
    I'm thinking a book cipher using nonsense text hand-written in the notebook as the key would be a fairly simple to use, yet obscure way to achieve this. The primary risk of these systems are the ubiquitous cameras present in so much of the urban world. Even cell phone cameras have the resolution to pick up text from a surprising distance. Operational Security would be needed to keep from opening the book in risky situations, reducing its utility. – John Deters Dec 22 '15 at 18:15
  • 3
    @JohnDeters a book cipher might work. One thing I bore in mind was the need for de-obfuscation to require nothing but the book and a brain. Maybe a puzzle-fan's brain. Worst case CCTV would pick up both the obfuscated password and the plaintext as it was typed. This would also be an issue of copying a password from a smartphone app to a computer. – Chris H Dec 22 '15 at 20:06
  • 1
    Hey, people, I thought you were information security experts! If my internet banking admin used any of these techniques, I would sue him. This whole question should be closed as "dangerous", because all users will read it and think: "Great! They say it is OK to put all my passwords on a piece of paper!" – vojta Dec 23 '15 at 07:32
  • 1
    @vojta I think the first sentence in the question -- "Answers to the question "How safe are password managers like LastPass?" suggest that storing **personal passwords**" -- makes it clear that we're not talking enterprise-level security. :) – tmh Dec 23 '15 at 08:01
  • @tmh now you suggest a good question: *how can a security-conscious sysadmin keep track of all their passwords?* The answer would be informative even for those of us who aren't. – Chris H Dec 23 '15 at 08:06
  • @ChrisH Feel free to ask that question. – tmh Dec 23 '15 at 08:07
  • 1
    My suggestions only work well for random strings. If someone got their hands on the book, tried a few simple manipulations and got real words it would encourage them to keep trying even if the words were (say) anagrams of your passwords. – Chris H Dec 23 '15 at 08:19
18

I created a language for this purpose. None of the symbols look anything like English (no telling if they look like any other language), there are no spaces, several letters are missing, common patterns become single symbols (dis,ing,etc) to prevent easy decoding, it is written from top to bottom, right to left, in a grid with out lines, and I used trash to pad each line.

Depending on how I'm storing it, I also use a shifting code wheel that adjusts on last letter placement. If the last used letter is something like h (caseless system) then add 7 to the next letters code wheel. You can include the code wheels on the page in the trash to further confuse an attacker. Since you can create multiple code wheels per page and shift the numbers how you like, it prevents easy attack. Another option is to overlap code wheels. If you're lazy you can use a number pattern like +5,-2,+3,6 like a PIN.

Kayot
  • 299
  • 1
  • 3
  • 1
    This could work well provided the key for what symbol corresponds to what character is never published, and you're using complex passwords instead of passphrases so that statistical analysis is ineffective. –  Dec 22 '15 at 20:56
  • 9
    How long do you need to decipher one password? Sounds like it would take several minutes (which is not a bad thing, just a little uncomfortable maybe). Nice solution though. – Hexaholic Dec 22 '15 at 21:13
  • 8
    The more I used it (came up with it in middle school for passing notes and one hell of a scavenger hunt) the faster I got. After a few years in highschool I was able to read and write it using a cipher at about half my normal writing speed. Now days (12 years later) I use AES and thumb drives so I'm rusty and would need to dig up my original papers on it. The first draft used a single line with various patterns on it. Later on it got fancy with fake line brakes being made to look like music glyphs. Good times. – Kayot Dec 22 '15 at 22:17
12

Write a diary and embed the passwords within the entries. It will not look like a book of passwords. Someone will have to read it to notice the misspelled words. I used an address book where the addresses, phone numbers, and postal codes of close friends and family members which were PINs and passwords. I know my family members addresses and phone numbers, so having them recorded incorrectly didn't matter.

Eye Kneel
  • 121
  • 2
12

Use a mask.

No, seriously. Use something like medium-thickness cardboard, obtainable from office supply or hobby stores, to create a rigid grid mask, maybe 30x6 character slots in size, and cut out randomly placed holes for maybe 40-50 characters out of those. (You can obviously pick different dimensions, depending on your needs.)

To write down a password, place the mask on top of your notebook, write the length of the password through the first two holes (or pick a special character that always means "this is the end of the password" and write that at the end instead), then the password itself through the remaining holes (either lengthwise or per column first, again your choice), as many as needed. When you are done, remove the mask and fill in all remaining character slots with garbage characters; the more random, the better. To make this easier, start by drawing a grid in the notebook before you fill in the password.

When you need to read a password, simply place the mask on top of the jumble of characters and what remains visible will be the password plus whatever random garbage you used to fill in the character slots that aren't part of the password. (At that point you just need to know how long the password is, hence the termination character or recording the number of characters.)

Keep the mask safe but separate from the notebook, perhaps in your wallet. Consider the mask to be your "master passphrase" of sorts.

This won't really protect against an attacker that specifically targets your scheme and perhaps even you specifically, but it should provide a reasonable amount of security against someone who happens to get their hands on the notebook while having low overhead when you are legitimately using the passwords. The overhead here is when you record a new password in the notebook, which is often a situation that you are able to better control (for example, there is likely no need to change your bank password while you are at an Internet café in a random third-world country).

If you want to enhance the obfuscation factor even further, you can add an offset to the scheme: record how many characters at the beginning to skip when entering the password.

If there is a camera recording your notebook while you are entering the password, it seems just as likely if not actually more likely that it is also recording the keyboard you are using to enter the password, at which point you have lost almost no matter what scheme you use for obfuscating the written-down passwords.

user
  • 7,670
  • 2
  • 30
  • 54
11

A basic method to minimise the impact of someone being able to find out passwords from glancing over at the notebook would be to have one password per page - if you're looking at that one, that's all they can see.

Another alternative would be to have a Diceware or similar list, and note down the numbers. It adds a step to "decryption", in that the legitimate owner needs to cross-reference with a Diceware list, but it would probably slow down an attacker with access to the notebook for a brief period - they'd probably have to photocopy the whole list, as well as any site specific numbers to be sure of access.

Essentially, though, if the owner can "decrypt" instantly, an attacker can decrypt given time. If they have access for a while, they can clearly take a copy of the contents and work on it without you knowing (by making you find the book somewhere you would consider safe, for example - perhaps in your house where you normally keep your bag, where it might have fallen out naturally).

You could remember a fixed partial password, and only note the variable parts. However, in that case you are relying on none of the sites you authenticate against being breached - as soon as one is, you have to consider the partial part compromised, and change all passwords using it, just as if you'd used the same password everywhere.

The most secure option might be to have a physical safe which the notebook is kept in, and which is only opened when no-one else is around. It seems a little bit overkill for most uses, but that's pretty much the method used for some critical data, such as DNS root signing keys.

Matthew
  • 27,233
  • 7
  • 87
  • 101
  • At one password per page, that would be quite a big book -- my KeePass database has well over 100 entries. A bigger book wouold be harder to secure. – Chris H Dec 22 '15 at 14:20
  • 2
    100 entries would only need 50 sheets of paper, assuming you wrote one on each side, and that would expose the single password you're using, and 1 other. A 96 page notebook, at A7, is certainly pocket sized, and you're only putting a few words on each page (the site and the password) - you don't need a big book. From a quick Google, http://www.whsmith.co.uk/products/pukka-pad-pocket-book-a7-wide-ruled-notebook-200-pages/33728902 would be ideal – Matthew Dec 22 '15 at 14:28
  • Your factor of 2 makes a difference, I'll admit. I was thinking of something like [a credit card sized notebook](http://www.tokyopenshop.com/memorandum-card-p-241.html). – Chris H Dec 22 '15 at 14:32
  • 2
    I'm kind of assuming that beyond a certain point, this becomes unwieldy, and you jump to using a password safe type application from sheer frustration at having to search through a notebook! – Matthew Dec 22 '15 at 14:38
9

There are many better and more secure examples but I thought I'd mention one thing I've used in the past, which is mnemonics in the form of a drawings/comics to represent passphrases. This does require that you can vaguely remember what the passphrase was, however.

An example could be the phrase "Tommy's birthday is on March 23rd!". The comic could consist of a character you mentally recall as "Tommy", celebrating his birthday, with a punchline to a dad-joke (or something with a reference to the site you're using), and dated/signed on March 23rd. You could also add many more comics that do not represent passwords to further obscure them.

To someone walking by, this is merely your sketchbook. Most people are not interested in stealing doodles from a bad cartoonist, and especially would not expect it to be a book of passwords. In the event that someone does steal it and knows your system, they would still need to be able to understand how you mentally process your own drawings which is largely going to be subjective. This can also be hindered by adding filler information within each drawing to add noise to the password for anyone who's trying to decipher it. If you enjoy fantasy, you could even push this further with making mental "laws" about what matters in your fantasy world you portray through comics/drawings.

As I said, there are much better ways to store passwords physically but this may work for people who use mnemonics well and it can also be really fun!

6

Once upon a time, I wrote down the different PINs for my credit and bank cards. I converted them to base 9 and then added a spurious extra 9 somewhere in each number. I think that was pretty safe, but of course it only works for entirely numeric passwords such as PINs.

Mike Scott
  • 10,118
  • 1
  • 27
  • 35
5

I've come across several attempts at a wallet-sized reference card used as your password ciphertext. One example: http://www.passwordcard.org/en

I wouldn't use one of these, but if I did, I'd spend more time on my mental model of how I derived my password, which should provide enough obfuscation that you likely wouldn't be able to acquire the card and the password at the same time. If you were concerned about this, you'd need to come up with some way to shift your cipher. "Row number is the phone number digit with the third character in the domain name of this site, column is the second-from-last character converted to numeric position in the alphabet." So Google.com is O=6 on dial-pad, so sixth row, column is G=7 so seventh column, then decide some other factor for how many characters and which way you read or how you shift each character. Diagonal, up 1 & over 2, etc.

At least with this solution, you can lose the "notebook" and replace it later, and you don't over-complicate matters trying to come up with a secure scheme. If I handed you my "card" with the characters I actually used, the chances that you start in the right spot with any given website, and choose the right direction, length, and so on are negligible.

jth
  • 726
  • 6
  • 10
  • 1
    Note that replacing the public card needs you to have safely stored the card number, so you may be in square one. Rather than using the public cards (which can be easily replaced), I would use my own list and keep a copy. Maybe you could base the list from a common work, such as using the order letters appear in Shakespeare's play X, when starting on page Y (beware of letter frequency, though). That way, in worst case you would be able to reproduce the list from a copy of Shakespeare's plays. – Ángel Dec 22 '15 at 22:03
  • Either way you're making a copy. The notebook page of hand-written "random" data (haha) can also be lost. But it would be trivial to hide the number of the card in your wallet, or in any number of other places where that number alone would be on identifiable as the index for your password card. In any case, the core premise of this question the first place is pretty ridiculous. – jth Dec 24 '15 at 05:05
4

I use mnemonic clues. So I invent a password I can construct from the clues, and then only store the clues on paper. The clues might be a doodle, or part of a drawing, or something that reminds me what my password is. Or that remind me of the part I haven't memorized. So without knowing what my associations are, it would seem quite difficult for someone to figure out my passwords from my clues.

Does security through memorization count as security-through-obscurity? Seems to me that within the context of the question, this is as far from that as is likely, given that it's a password system, and it's a way to prevent deducing the password by looking at the notebook, unless someone knows me so well that they can somehow deduce from my clues. I'm pretty sure I can make up some passwords not even the people who know me best could ever infer, though that requires more intention to make up a passphrase that's an odd combination of things, which my only context for is remembering the phrase I made up.

Example - an abstract doodle with many symbols and passwords, and I choose a spot for a part of it where there is a little curve, and off in one direction there are three little marks and then a long one, but they aren't distinct from the many other squiggles and dots and so on. But I can remember they're the part I was using to remind myself of my password. The curve reminds me of a body part, and the first two words are that body part in two different languages, then the three marks are a three-tone phrase I know I will remember, such as "yo ho ho", and the slash is some final remark I'll also remember, such as YOW!. So this I can always cause me to remember "gomitoelbowyohohoYOW!"... but I don't think anyone else is even going to know where in my doodle to look, let alone deduce that password.

Dronz
  • 141
  • 5
3

You have a different threat model for written documents than for electronic ones but the way to handle them is pretty well known: restrict and audit physical access.

It doesn't matter if it's nuclear launch codes or the combination of your little sister diary's padlock except in the specific way you're going to perform that control.

This also means that, if you want to protect this data, you should not simply obfuscate it but encrypt it. One way of doing so could be to encrypt the data with a password, print the cypher text as a QRCode and store that. It doesn't give you much advantage over proper access control, though: it's certainly safer but it's pretty inconvenient to use and will likely fail you when you actually need it.

Stephane
  • 18,557
  • 3
  • 61
  • 70
  • 5
    You suggestion of encrypting+ storing the encrypted data as a QR code still relies on having a powered, trusted device capable of reading the QR codes and decrypting them. It's no real improvement storing a password database on the smartphone or equivalent. – Chris H Dec 22 '15 at 13:43
  • It provides mitigation to the threat model of the OP: someone glancing over his shoulder while he reads the paper (or, more precisely, it provides a two-step requirement for acessing the cleartext: having physical access isn't enough). What I'm /really/ suggesting, though, is not to bother with this and concentrate on good physical access control – Stephane Dec 22 '15 at 13:50
  • Even fairly simple obfuscation protects against shoulder surfing except for thieves with a photographic memory. Physical access security on a par with that for credit cards is reasonable, anything beyond that would be difficult. With a credit card you have the card and a small piece of secret information -- I propose in my answer an equivalent, hopefully improved. What the credit cards have that this doesn't is an easy means of cancelling them, also fraud detection may not be assumed for passwords. – Chris H Dec 22 '15 at 14:00
  • 2
    I think we should aim for a higher standard, in this place, than "it'll protect your notebook against your young brother". Obfuscation never was and never will be adequate general purpose protection but it can definitely induce a false sense of security. What if the overlooker simply has a phne ? Or goggle glasses ? or is a security guard with a camera ? Obfuscation adds a high degree of complexity for very little added protection. – Stephane Dec 22 '15 at 14:19
  • 4
    Now CCTV is a real issue -- look at how often it can see PIN keyboards. Some pretty respected people in the field have been saying for years that actualy writing down passwords is a good approach, so looking at ways of defending against even fairly simple attacks on that seems sensisble. With attempts to push people into using online services whether they like it or not, offline security may be a good approach. Without resorting to stereotypes, I'm sure we can all think of people who don't have a smartphone and shouldn't be running password a database on their PC because of malware. – Chris H Dec 22 '15 at 14:27
  • 1
    @ChrisH And using the password relies on having a powered, trusted device capable of accessing the resource to which the password corresponds. – Blacklight Shining Dec 22 '15 at 20:33
  • 3
    @BlacklightShining. There's trusted and there's trusted. Webmail on a friend's machine when travelling for example is a rather different case to banking from an Internet Cafe. There are plenty of occasions when a small risk of one account being compromised is worth taking, or the risk of not logging in is greater than the risk of logging in on an untrusted machine (hotel machine to print e-tickets that are only available a day before flying and without which you couldn't fly). – Chris H Dec 22 '15 at 20:43
2

Write you passwords in invisible ink.

Take a regular book or a notebook that served a different purpose (school notes) and write your passwords in the margins using an ink that can only be visible with a UV light. Anyone who looks at the notebook/book will assume it is what is appears to be while you still have access to the passwords.

Note: I do not know what the lifetime of invisible ink is when used on paper.

Eric Johnson
  • 715
  • 1
  • 6
  • 11
  • 2
    I suspect that you shining a purple light at the notebook might give a bit of a clue to this one! – Matthew Dec 22 '15 at 16:56
  • You would have to view the passwords in private, but if the book was laying out in the open on your desk, no one would be able to even know it was your password book. The UV light would be kept on your person, or far from the notebook as to not attract attention. – Eric Johnson Dec 22 '15 at 17:01
  • 2
    I would indeed find it a bit impractical to rely on an UV light source and privacy every time I wanted to look up a password. However, invisible ink might be useful if you want to keep a backup of the notebook, which you don't need to consult on a regular basis. – tmh Dec 23 '15 at 10:27
2

In 7th grade our class had us write a journal. I used a simple code which used novel symbols for letters, and noted that at the back. But I soon memorized it and easily wrote it directly.

Using novel symbols is less confusing than using a substitution cypher of the letters. In fact it's rather easy.

It obfuscates but can be broken via normal techniques... if you have normal English (or whatever) text! For passwords of random letters, it's quite safe unless you have some way to break some entries and use the results to read others. That can be improved by having multiple entries and using another hidden method of knowing which one is right.

JDługosz
  • 1,138
  • 2
  • 7
  • 12
1

Just for the sake of completeness, per comments to the question:

Use an existing text or book and derive passwords from there

Print out an article or take a book with you, preferably one that wouldn't arouse any suspicion in the environment(s) you're planning to use the "notebook".

Decide on an algorithm how you derive passwords from the text in the book. Something like "from the first ten words of a specific paragraph, take the first letter and put them together to form the password" is probably a bit too simple, but you'll surely find a personal algorithm that is a little harder to guess.

To map passwords (i.e. parts of the text) to accounts, you basically have two options, but they can also be combined:

  • For an account, choose a passage of text that somehow relates to the theme of the account. This requires a little creativity. For instance, the part of a short story where the main character sends a letter to her friend might indicate that the password to your e-mail account is hidden there.
  • Put sticky notes or similar in the book. Mark parts of the text and write notes next to them. It is perfectly normal for anyone who's studying a text to sprinkle it with all kinds of annotations. Especially if you're taking this book with you all the time, this is most plausible. Take care that your notes don't make it too obvious that a passage may contain a password. Maybe also mark some parts of the text that do not contain passwords, to draw away attention.

It might come across as just a little strange if you're going to run around with the same book for the next ten years. However, passwords are meant to be changed from time to time anyway. So after some time, get a new book, prepare it as suggested above and change your passwords.

As a bonus, you may want to choose a book that contains source code listings or otherwise technical parts. The idea behind this is that they naturally consist of a lot of special (non-alphanumeric) characters. This way, you can more easily derive a password with special characters from the text.

tmh
  • 1,139
  • 1
  • 9
  • 10
0

Rule number one: DO NOT WRITE DOWN YOUR PASSWORD

In the late 60's businesses started using mainframe computers. This was a new concept in business. The owner of the business would find someone that had any aptitude (see had a college class where they actually saw a computer) and ask them (under threat of termination) to become the sysadmin. The new administrator would be provided a login and password. This was a new concept for lots of people. So, they wrote down the password, just in case.

Multiple people were using the mainframe under the same account. The problem was that someone would configure everything for a batch process, come back later to finish it, and discover someone else had gotten in and reconfigured everything for their batch process. It wasn't very efficient. Accounts got set up, and logins and passwords were handed out. And of course, the passwords were written down.

In the 80's it was time to put computers on peoples desks. They were all connected through a network back to the mainframe. This way you didn't have to walk away from your desk to get the results of the work you had the mainframe do. It also gave people just enough horsepower at their desks to do some of the tasks they had the mainframe do. Many systems required eight character passwords to help prevent simple, popular ones from being guessed. Since passwords were now more complex (oh, look, password has 8 characters, and no one would guess it), people wrote them down.

In the 90's there was this new fad that everyone was getting excited about. It was called the interwebs, no, intertoobz, no, wait... Internet. And systems were getting connected. We could send an email instantly instead of having to write one and mail it. So, we started using letters, numbers, and characters in our high security 8 character passwords... that we were still writing down.

In the... ought's(?) we started banking, purchases, and school on line. We created accounts, and used the same password to protect them all. And to make sure we didn't forget this password, we wrote it down.

Here we are in 2015. The average person has 30 different logins and passwords that they have to remember. They should be 15 characters in length, non language based words that include symbols, numbers, and upper and lower case characters. There's also a list of things they absolutely shouldn't be.

Now, I get that we have spent 5 decades training people to violate rule number one. I also get that people hate change and technology.

I don't care what the excuse is. Yes malware is a consideration. However, when you do a real risk analysis, malware is not as big a risk as writing down your password. You may think you are awesome tricky at coming up with a system to hide your password.

All I need is to shoot a photo of a page, and I have as long as I need to crack your password. Once I figure out your system, I can get into anything in the book. That is why this is an unacceptable answer. A computer is a better solution than you are. If it wasn't the case, governments wouldn't be using computers to create and control passwords.

Everett
  • 1,506
  • 1
  • 12
  • 20
  • 2
    According to this logic, there seems to be no good reason to encrypt the passwords stored on a computer, either. All it takes is a copy of the cypher text, and you have as long as you need to crack the passwords. A "real risk analysis" can cover multiple threats for which writing down your password is an acceptable way to mitigate those risks. – schroeder Dec 23 '15 at 21:43
  • 2
    Not only is this not an answer, it is a long history that is unrelated to the question being asked. – schroeder Dec 23 '15 at 21:44
  • @schroeder no, you're right. We should just tell people to write their passwords down. We don't have any evidence that it's a bad idea, and we definitely don't have any evidence that it is entirely different than storing them in an encrypted system that is controlled because it would use encryption that is just as easy to crack. Look up logical fallacy of equivocation. – Everett Dec 23 '15 at 21:50
  • Imagine for a moment you're sitting in court. You are explaining why you were writing down passwords in this "encrypted" manner. First they put someone on the stand that makes it clear, encryption requires public vetting. They demonstrate the problem with assuming you know encryption (WEP). Then the defense puts on the stand experts that state that people have been told for years "don't write it down." Next come the policies. Is the company going to accept liability for you doing something stupid? Not likely. So, is it my job to help someone do something that is bad in every sense of the word? – Everett Dec 23 '15 at 21:58
  • I'm not going to even start enumerating the logical errors you've fallen into. Let me make it simple. This does not answer the question, and the majority of the answer is irrelevant to your conclusion. At best, your first line is a useful comment. – schroeder Dec 23 '15 at 22:50
  • @schroeder The purpose of the history is to demonstrate: we knew what rule number one was 55 years ago. We've spent 55 years violating it, and teaching people to violate it. So now, here we are, having a discussion, where we rationalize violating it some more. We are giving bad advice that would make someone liable for using it. That is a fact. So please, keep telling me about how I'm in the wrong. – Everett Dec 23 '15 at 23:28
  • 2
    So... don't keep your written passwords taped to your monitor? I understand it's easier to access written passwords once found but I think outside of a business scenario, most people would be more likely to lose their accounts to keyloggers rather than theft of a notebook with some obfuscation. I understand your frustration though, and agree that written passwords would not mix well with a general office environment. –  Dec 24 '15 at 01:01
  • In a corporate environment, I'd always use a password manager. Not only do I agree that it is more secure, it's also often the case that one needs to handle a whole lot of passwords, where anything handwritten would really turn out impractical. On the other hand, a business environment comes with proper infrastructure: You can count on backups, availability of devices etc. When it comes to personal passwords, travel etc., requirements may simply be different... You probably wouldn't want to build a whole IT infrastructure around keeping your passwords safe. – tmh Dec 24 '15 at 07:13
  • So what is the lesson of 55 years? Hmm.. I don't remember hearing about anything bad happening to millions of users who wrote down their password. I *do* remember hearing about millions of users having their passwords stolen from computers. – John Wu Mar 14 '17 at 16:23
  • @JohnWu Stolen from the computer that is controlling access... yes. Writing your password down wouldn't protect you from this, as the password (in a hashed format) is stored on the system you are trying to access. So you don't really have a point with this comment. – Everett May 29 '17 at 15:13
-1

Write/print a piece of paper full characters or use a already written book or an old essay from school, memorize some position and pattern and done.

5000 characters fit on a one page, there are 5000^n different patterns you could potentially take, so with 0 information, the paper is harder to crack than a simple brute force attack on the password itself.

If the number of password attempts is not hard limited, then you will need to print special characters and upper lowercase on the paper aswell or have a long password alternatively.

You can also make some fake marks/fake riddles/fake words onto the paper to seduce an attacker into trying to log in and alarming/informing you potentially.

HopefullyHelpful
  • 1,254
  • 1
  • 12
  • 17
  • this is mostly covered by jth's answer – schroeder Mar 14 '17 at 16:21
  • I disagree, while the approach is similiar, it's not the same, also mine is more concise. The password card only has 228 characters and is from the internet. Also the scheme is stupid, it actually asks you to memorize 2 things that are even harder to remember than 1 symbol for the start of your password. It also recommends using a stupidly simple pattern. It's easily bruteforceable. – HopefullyHelpful Mar 14 '17 at 16:54
  • You forgot that you have to remember the *pattern* in your scheme - once you do that, your entropy plummets and it doesn't matter how many characters you have, it's easily bruteforceable. Plus, the card is portable ... This answer is not appreciably different. – schroeder Mar 14 '17 at 17:45
  • Well, the base is a lot higher and the amount of possible pattern that are easily remember is a lot higher, because of more choices. That means my answer is appreciably better in any regard. And a sheet of paper or book is easily portable aswell. And if you use your master password that often, that you log into every social-media-account with lastpass on the go, then your password probably won't matter anyway. The entropy of the card is actually lower than that of brute force on ascii passwords, my answers is actually higher, even if you reduce the memory for the pattern to a minimum. – HopefullyHelpful Mar 14 '17 at 18:19