No, don't write down your passwords.
Hi, everyone. Leo Notenboom here for
Askleo.com
My most recent copy of AARP magazine
included an interesting section called Tech for Everybody.
They talk about tech periodically
in the magazine, but this was a section dedicated to the topic.
On the cover was an interesting headline.
It basically said, Where to store all those passwords?
We have the answer.
Well, of course, that got my attention, right?
What would their answer be?
There are many possible solutions to this problem.
Which one would they choose?
Their choice was disappointing.
They chose the worst one.
Here's a quote from the article.
Laurie Faith Krainer,
Director of Carnegie Mellon University's CyLab Usability, Privacy,
and Security Laboratory, says the old-fashioned way is the best.
People used to go around saying, don't write down your passwords.
Ignore that advice.
You should write down your passwords.
Of course, keep that record someplace secure, not out in the open.
Let me be super clear.
This is horrible advice.
Do not write down your passwords. Yes, absolutely.
I'm one of those people who goes around saying, don't write down your passwords.
I have good reason for that.
There are two.
The one you might expect, but the one that's actually more important.
The classic reason, of course,
is that whatever you write your passwords down on is as secure as that thing is.
By that, I mean if you've got a piece of paper onyour desktop?
Well, anybody who has access to your
desktop, and I mean physical desktop, has access to that piece of paper.
If you've got a sticky note on your
monitor, anybody that comes up to your computer is going to see your password.
If whatever is written down is easy
for you to access, it is easy for someone else to access.
Now, here's the problem.
This is an issue.
Don't get me wrong,
but it's not as big of an issue as a lot of people make it out to be.
It's almost but not quite a red herring.
My opinion, there's a much, much bigger issue with writing down your passwords.
The bigger issue is simply this.
You'll choose worse passwords.
For example, you'll choose passwords that are easier to write,
easier to read and type, and of course, easier to type in general.
In other words, you're not going to be
choosing those 16 completely random characters if, when you have to type them
in, you get them wrong,
you can't read your handwriting, it's a lot of uncharacteristic typing for you.
You will end up choosing passwords that are less secure, less random, and shorter.
And you're more likely to reuse passwords.
I know that you probably will say that, No, I won't.
I will write down a brand new password for every account that I create.
You won't.
The temptation will simply be too great, and the inconvenience of having to write
it down and type in something else for yet a different account will be too great.
You'll look at your list of passwords and say, You know what?
That password there, that's good enough for this account.
I'll just reuse it.
Don't.
Now, there is one exception to this blanket never write down your passwords.
And that is simply this.
It is completely acceptable to
keep a written list of all your passwords if two conditions are met religiously.
One, you keep that written list secure.
And by secure, I don't mean on your desk or under a pad or something like that.
I mean lock and key secure, in a locked drawer or in a safe or something.
Yep, it's going to be more inconvenient for you to get at, but that's the point.
It's going to be more inconvenient
and significantly less likely for someone else to get at.
Keep it locked.
Number two, you use lengthy pass phrases.
I get the typing issue. I really do.
The struggle is real.
I have at times had to manually type
in a long, in my case, 20-character password of completely random characters.
It is very painful.
I get it wrong half the time.
The solution for anything that you
actually have to type is to use lengthy pass phrases.
So instead of a 20-character password, which is wonderfully secure
if the characters are random, you choose instead a 24 or a 30-character
pass phrase, four or five words that aren't a phrase.
They actually aren't a phrase
in the English language, but they are a sequence of words
that are easy for you to type because we all know how to type words.
It's the randomness that gets in our way.
So by choosing five or six or whatever number of words makes sense that gets you
up to a longer password, you now have something that's easier to type.
But remember, you have to do both of those religiously.
Make sure that your password list on paper is always under lock and key,
and for every account, you do a passphrase.
If you can adhere to both of those, paper is fine.
But you know what?
You can't.
There are sites that won't allow you to use a passphrase.
Putting it in lock and key is going to be
a problem for you because it's going to be inconvenient enough that you'll just leave
it on your desk or leave it behind or something.
The other solution
that the AARP article mentions is to use your browser's password manager.
I disagree. In fact, I've got an article
on that that will be linked in the companion article for this video.
The bottom line is that it's okay-ish.
It's certainly, in my opinion, better than writing them down.
But when you use a browser's password
manager, you are now locked into that browser's ecosystem.
If you're using the Chrome password manager, then your passwords are only
going to be available in Chrome and it's related software.
That's seriously inconvenient to the point
where when you need to do something else, you're going to compromise your security.
You know what I'm going to say.
You know what I'm going to suggest you do.
You know what I'm going to recommend is that is use a password manager already.
Just do it.
I have recommendations.
I'm not even going to say which specific one you should use.
You should use the one that makes the most sense for you.
If you figured out how to send email, you can figure out a password manager.
If you figured out how to navigate
complicated websites and shop online, you can figureout a password manager.
If you've figured out how to navigate
complicated websites and shop online, you can figure out a password manager.
If you've figured out how to deal with Facebook's bizarre interface
and interface changes, you can figure out how to use a password manager.
You can. You get the idea.
Don't be frightened by the perception of complexity.
It doesn't have to get in the way.
And by all means, don't let that stop you from using a password manager.
A good password manager will actually make your life both simpler and more secure.
For updates for links related to this topic, like the one I mentioned about
using browser password managers, visit
Askleo.com/16247. Askleo.com
I'm Leo Notenboom, and this is Askleo.com
Thanks for watching.