Think about this with common sense.
- If you will write your password down - then it can be found and read by others unless stored in really safe environment;
- If you will not write your password down - there is no possibility for someone to find it and read it from the paper.
Also, passwords for different accounts must be treated in different ways. Password for your banking account should be secured more carefully ( or not less ) than password for something which is not critical ( i.e. on-line game).
Password itself is useless. Data and account secured by the password - these are things which should serve as criteria of how much effort should be applied in order to prevent anyone finding out the password.
As example - I would not mind write my password from WI-Fi access point at my apartment - because it is fine with me if someone who lives with me will find out this password.
But I will not do this with password for my e-mail - because it is not fine with me if anyone but myself will access it.
Edit:
In addition to that a general rule which can be applied here is:
Every time you are typing or writing your password (would it be login procedure or writing down your password) you lessen its security just because it left your head and now exists as written thing which can be read or gotten by sniffing network traffic. Hackers will have more chances to sniff your password if you log in over the network 70 times per day. If you log in once in a month they have less chances to get it.
Same thing with written down passwords. Every time you write it down its security lessens, because now it also exists outside of your head.
The best security practice about passwords is to store them only in your head :) But i admit that we cannot remember all passwords (except if you put the same everywhere, what is not very secure neither). Personnaly i use this little software that had an embedded crypted database : http://keepass.info/
– user2196728 – 2014-01-01T17:43:24.8301Anytime your password can be obtained by anyone you jeopardize the integrity of all the data you have access to. So yes, it's an agreed-upon policy, SOP for security checks includes looking for files or notes with passwords in plain text. So no, you only hurt yourself if you write down your gmail password, but you jeopardize an entire company if you write down your ERP password. – Raystafarian – 2014-01-01T17:43:25.820
If you use a program like Robopass or keepass at least all your passwords are encrypted. Yes, you do have to have a master password, but the rest are securely encrypted. Unless the master password is too weak then you have made the problem worse. – cybernard – 2014-01-01T17:50:53.613
This is such a broad question, the majority of answers will explain how to protect passwords. I think the question is why shouldn't passwords be recorded? and should site policies and accepted standards. You may want to edit the question to reflect that. Or it might do better on InfoSec
– Raystafarian – 2014-01-01T17:54:16.313possible duplicate of Proper password safety?, How to store passwords
– Ƭᴇcʜιᴇ007 – 2014-01-01T19:39:24.180