Reply to post: Re: "Nothing can go wrong with this"

LastPass now supports 2FA auth, completely undermines 2FA auth

Ben Tasker

Re: "Nothing can go wrong with this"

Those who believe pen and paper is decrepit, inflexible and open to abuse from someone close to you unless a cipher get used. Then there's the camp who believe if it can be hacked- it will.

The two aren't mutually exclusive. It's about assessing the risk you're trying to counter.

Whilst it'd be easy for someone nearby to nab your password book and take photos, it requires physical proximity, so as long as you're actually securing the book you've probably got a low risk of that happening (outside of being deliberately targeted). Post-it notes on the back of your keyboard are another matter though, as you've not taken steps to secure them.

Stored online, on the other hand, there's no physical proximity required and anyone with an internet connection can have a go (though not all will have the ability to be successful). It takes away the advantage of physical proximity (leaving aside people should-surfing your master password) but opens the number of possible culprits from a select few to potentially billions of people.

There's also another risk inherent with trusting a third party with your credentials - they might, without malice, make a mistake that leads to credential leakage. That's another risk that isn't present with a little book of passwords.

To be honest, I see it more as a convenience trade-off than a security decision. If passwords are in a little book, and you haven't got that book with you, you're out of luck. If their online, then you can get at them any time (the problem being, that others could too).

If you were after ultimate password storage security (with convenience not being a consideration), you'd generate long random passwords, write them in a book and lock that book in a safe that no-one else can open. Of course, you're screwed if you need a password while at work, or if the house burns down.

Cloud based password managers are still better than memorising (and re-using) a small number of less complex passwords, but anyone who tells you they're more secure than pen, paper and a little bit of effort is an idiot.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon