Is it dangerous to write down passwords?

Question

I have a list of passwords for some sites I use on an Excel spreadsheet (no macros or anything in it). I've read many places (online and offline) to "remember your password or write it down in a safe place", but others say to "never write down a password!". Is there a consensus in the security field if this is an acceptable thing to do?

As an example of consensus, I know that the advice "do not use an administrator account for non-administrative tasks" is almost universally given/accepted. Is there a similar level of agreement on this stubject?

Edit:

To clarify, I'm specifically looking for the "best practice" agreed on in the field - if there is one - because the advice given by various sites and sources that use passwords are in conflict with each other.

Answer 1

The core idea of passwords is broken. (I know this is a little off topic, but bear with me.) When they were developed analytical machines had not become an idea, and getting a password wrong meant you got kicked at a minimum. By the time unix was being developed, it was already known that passwords had some weaknesses, but as there were physical access controls (door locks) most people were not concerned. Networks changed everything, It just took a while to realize it. No longer were physical access controls effective, and the need for access control grew. Engineering held this at bay for a while by looking at how quickly computers could guess passwords and how much we could remember. These calculations were stretched and broken by advances in computing speed. These days the minimum possibly secure password is longer than we can remember. And every person you share a password with weakens its security. At a minimum for a password to work you must share it with the service requiring authentication, so using the same password with multiple services weakens it further, and using different passwords with different services stress your memory.

So what should you do about it? Until non-password authentication becomes an option here is the current best policy (which has known weaknesses):

1. Use different passwords with each service generated with no attempt to make passwords you can remember.

2. Record each password someplace that can be secured.

A password management tool will help in this, and I would recommend using it for low and medium security passwords. For high security passwords and for the password to your password management tool I would write the password on a single sheet of paper (not a pad) on a hard surface that will not pickup impressions from writing and place them in a lockbox or safe.

This is not a perfect solution.

Answer 2

Think about this with common sense.

1. If you will write your password down - then it can be found and read by others unless stored in really safe environment;
2. If you will not write your password down - there is no possibility for someone to find it and read it from the paper.

Also, passwords for different accounts must be treated in different ways. Password for your banking account should be secured more carefully ( or not less ) than password for something which is not critical ( i.e. on-line game).

Password itself is useless. Data and account secured by the password - these are things which should serve as criteria of how much effort should be applied in order to prevent anyone finding out the password.

As example - I would not mind write my password from WI-Fi access point at my apartment - because it is fine with me if someone who lives with me will find out this password.

But I will not do this with password for my e-mail - because it is not fine with me if anyone but myself will access it.

Edit:

In addition to that a general rule which can be applied here is:

Every time you are typing or writing your password (would it be login procedure or writing down your password) you lessen its security just because it left your head and now exists as written thing which can be read or gotten by sniffing network traffic. Hackers will have more chances to sniff your password if you log in over the network 70 times per day. If you log in once in a month they have less chances to get it.

Same thing with written down passwords. Every time you write it down its security lessens, because now it also exists outside of your head.