How should I store a physical written copy of my password?

Question

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, then. Should I? If so, how? I'm not talking about password management software, I'm talking about being able to log on and use said software in the first place. Note that I am fallible, and it is thus entirely possible that I lose the paper I wrote my password on.

Answer 1

You need to take your threat model into account. Will people literally destroy a house to get your backup password? Will anybody even look for it?

You also need to take into account how likely you are to forget the password, and what kind of information will be available to an attacker that recovers it.

Assuming that you are not under a severe threat, simply writing it down and storing it in a fairly secure and nondescript hiding place will do. Place it in a book, tape it underneath your sock drawer, etc.

If there will be people actively looking for it, you may need to take more spycrafty (is that a word?) steps, such as laminating it and burying it in the ground, placing it in the freezer inside a piece of frozen fish, spackling it into a wall and painting over it, placing it inside a pen, etc.

You can also take several random values, xor them together, and use that as a key to encrypt it. Keep the encrypted copy in the open, then store the random keys in different locations, so that all will be required to regenerate the key and unlock the password. This may be a more secure method regardless of how the distributed secrets are hidden, because it will increase the work of someone looking for it, especially if they do not know how many secrets are required to regenerate the key.

If the information is very sensitive, you should increase the security level even if the threat is low. Required security = threat level * damage from exposure, in this case.

Answer 2

You should stored it in a sealed envelope, in a locked box, in a safe deposit box, as long as you're not concerned about either bank authorities or local law enforcement (particularly when traveling abroad).

Alternately, have one, or ideally two or more, KeePass databases (make sure to use the 1 second delay iteration count increase under Database Settings, Security, and then increase it) and/or a Hardware Encrypted drives stored in safe deposit boxes.

Then write down the KeePass password, which is ONLY used for the KeePass databases in the safe deposit boxes, and is long (20+ characters) and generated by KeePass, and either give that password to a trusted friend who DOES NOT have access to the safe deposit boxes, or store it in a different institution's safe deposit box.

Then, to get your passwords, at least two institutions/people need to be compromised.

Answer 3

I would say it depends on how frequently you need to read the password and how important and sensitive knowledge about your password is.

If you need to access it frequently and it is moderately sensitive, you could write it on a piece of paper that you put into your wallet. Assuming that you care about not losing your wallet with credit cards and cash, you are less likely to lose the piece of paper. As you will likely not let anybody take you wallet easily nor take a look inside and always carry it on your body it is quite a good place to put it. This is also a good place, in case you house is burning or has a severe water damage, which would destroy documents (assuming you are not in your house and have your wallet). The problem is actually, that you might get robbed or really lose your wallet if you are not careful. Thus you should always have at least a second copy.

The second copy (and additional copies) or infrequently accessed passwords could be stored in a self-storage or if you need more security in a safe deposit at a bank. Depending on how paranoid you are, you could use some anti-temper methods (sealed box) and/or use steganography (invisible ink, hide password in text).

For stronger security you would encrypt the passwords and store the key in a safe place, like a hardware token. The problem with this is availability and possibly also security. You have a big problem if you lose it and if you are arrested or robbed another person could take that hardware token. Redundancy would be necessary.

Answer 4

I would try to use passwords which are easy to remember and have enough length (as per Randall Munroe proposal). To make password more hard to guess and share by spelling or writing down on paper use upper case or special characters which are on keyboard in place of regular characters. Eg. password123 can be PassWord!2#. Remember only the first string and where Shift should be used.

Answer 5

Write it on a piece of paper with other gibberish words and stick it in your wallet. If you lose your wallet, probably unlikely, and someone finds it...and they are actually interested in hacking you...and they have your LID (of course a GF or wife may have this and access to the wallet) they will have to figure out which is your password. On top of that if you mix in some oddball variable letters that aren't actually part of your password on the password(s) on that paper they probably won't decipher it/them. The LIDs are the half of password protection that people tend to forget about. If no one else knows your logonID the password does them no good anyway.

You can also do a similar thing with an electronic file. Mix your password(s) into a text file that someone would glance at and think is a normal irrelevant text file. Create a meme GIF or JPG with your password mixed into some text somewhere in the image on it (like fake swearing - @#$%w7*!!). Another option is to memorize 5 or 6 decent passwords and use those across all your applications or systems. If you are required to update them periodically simply change one character in a consistent place each time (some password update requirements will not allow that but will require a wholly new password).

Hope this helps. Should be enough to deal with normal password hassles unless you are working on something that the Chinese govt or NSA are after...but at that point passwords really don't matter anyway do they?