Re: Writing passwords down [was: a passwordless operating system]

From	Michael Stone <mstone@debian.org>
Newsgroups	linux.debian.user
Subject	Re: Writing passwords down [was: a passwordless operating system]
Date	2024-12-17 17:10 +0100
Message-ID	<JUIiZ-fKY-3@gated-at.bofh.it> (permalink)
References	<JTRHH-h9O8-5@gated-at.bofh.it> <JTXap-hd9b-1@gated-at.bofh.it> <JUwUx-8vi-5@gated-at.bofh.it> <JUxnz-8U5-9@gated-at.bofh.it> <JUyCZ-9Eu-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Dec 17, 2024 at 06:45:05AM +0100, tomas@tuxteam.de wrote:
>Do you have a reference?
>
>I ask because I'm in the middle of a discussion (and that was my advice,
>too). Seeing what Schneier has to say on that would be very interesting.

All of this advice is overly simplistic. The right answer depends on 
understanding your threats and making a conscious decision what risks 
you want to mitigate and which you want to accept. If your threats 
include a coworker using your account to get a higher level of access 
than permitted, or to avoid/shift accountability, then putting your 
passwords on your monitor at work with a post-it is a tremendously 
stupid idea. If your threats include a person in your home (e.g., health 
aide, plumber's assistant, whatever) potentially accessing banking 
information, then putting your passwords on your monitor at home is a 
tremendously stupid idea. If your main threat is forgetting a password, 
and you don't have to worry at all about anyone else seeing your 
post-it, then putting your password on your monitor may be a very good 
idea. Putting your passwords in a notebook in a drawer may be a 
reasonable mitigation in some environments, but not others. Locking the 
drawer may or may not be an effective additional layer. People like to 
throw out bombs like "passwords should be written down" for shock value, 
but reality needs more effort and significantly more nuance. Schneier 
would, I think, agree with this as he already has nuances like "put it 
in your wallet". The problem of an elderly person with memory problems 
that potentially does/will have people in their home is particularly 
difficult as the wallet advice has minimal utility--there do exist 
people who take advantage of the elderly and steal their money, 
sometimes from their wallet and sometimes from their accounts, and if 
both are vulnerable it is not effective to secure one with the other. I 
don't think there is a good, general, simple answer to this without much 
more knowledge of the particulars of the situation than is probably 
appropriate for a mailing list.

Thread

a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-15 09:00 +0100
  Re: a passwordless operating system debian-user@howorth.org.uk - 2024-12-15 14:50 +0100
    Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-15 15:30 +0100
    Re: a passwordless operating system songbird <songbird@anthive.com> - 2024-12-17 05:00 +0100
      Re: a passwordless operating system John Hasler <john@sugarbit.com> - 2024-12-17 05:30 +0100
        Writing passwords down [was: a passwordless operating system] <tomas@tuxteam.de> - 2024-12-17 06:50 +0100
          Re: Writing passwords down [was: a passwordless operating system] "Loris Bennett" <loris.bennett@fu-berlin.de> - 2024-12-17 08:30 +0100
            Re: Writing passwords down [was: a passwordless operating system] <tomas@tuxteam.de> - 2024-12-17 08:50 +0100
            Re: Writing passwords down [was: a passwordless operating system] Mike Castle <dalgoda+debian@gmail.com> - 2024-12-17 18:00 +0100
          Re: Writing passwords down [was: a passwordless operating system] Jeffrey Walton <noloader@gmail.com> - 2024-12-17 15:30 +0100
          Re: Writing passwords down [was: a passwordless operating system] Lee <ler762@gmail.com> - 2024-12-17 15:40 +0100
            Re: libreoffice/openoffice system theme <tomas@tuxteam.de> - 2024-12-17 16:00 +0100
          Re: Writing passwords down [was: a passwordless operating system] Michael Stone <mstone@debian.org> - 2024-12-17 17:10 +0100
            Re: Writing passwords down [was: a passwordless operating system] Jeffrey Walton <noloader@gmail.com> - 2024-12-17 18:30 +0100
              Re: Writing passwords down [was: a passwordless operating system] "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2024-12-17 18:40 +0100
            Re: Writing passwords down [was: a passwordless operating system] <tomas@tuxteam.de> - 2024-12-17 18:30 +0100
              Re: Writing passwords down [was: a passwordless operating system] Jeffrey Walton <noloader@gmail.com> - 2024-12-17 18:40 +0100
                Re: Writing passwords down [was: a passwordless operating system] tomas@tuxteam.de - 2024-12-17 19:30 +0100
                Re: Writing passwords down [was: a passwordless operating system] Nicholas Geovanis <nickgeovanis@gmail.com> - 2024-12-17 21:10 +0100
          Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-17 18:50 +0100
            Re: Writing passwords down Peter Hillier-Brook <phb@hbsys.plus.com> - 2024-12-17 20:20 +0100
              Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-17 20:50 +0100
                Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-18 06:00 +0100
                Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 11:00 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 18:20 +0100
                Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-18 19:00 +0100
                Re: Writing passwords down "James H. H. Lampert" <jamesl@touchtonecorp.com> - 2024-12-18 19:10 +0100
                Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-18 20:10 +0100
                Re: Writing passwords down pocket@homemail.com - 2024-12-18 21:20 +0100
                Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 19:30 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 20:30 +0100
                Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-19 06:00 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 20:30 +0100
                Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-18 23:10 +0100
                Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-19 02:20 +0100
                Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-19 02:20 +0100
                Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-19 02:30 +0100
                Re: Writing passwords down Karen Lewellen <klewellen@shellworld.net> - 2024-12-19 02:40 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-19 10:20 +0100
                Re: Writing passwords down Joe <joe@jretrading.com> - 2024-12-19 12:20 +0100
                Re: Writing passwords down Max Nikulin <manikulin@gmail.com> - 2024-12-20 04:30 +0100
                Re: Writing passwords down George at Clug <Clug@goproject.info> - 2024-12-20 05:40 +0100
                Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-20 05:40 +0100
                Re: Writing passwords down Jeffrey Walton <noloader@gmail.com> - 2024-12-20 06:10 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-20 10:50 +0100
                Re: Writing passwords down George at Clug <Clug@goproject.info> - 2024-12-21 01:40 +0100
                Re: Writing passwords down Max Nikulin <manikulin@gmail.com> - 2024-12-21 04:30 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-20 10:30 +0100
                Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 10:20 +0100
                Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-18 10:20 +0100
                Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 10:30 +0100
                Re: Writing passwords down Chris Green <cl@isbd.net> - 2024-12-18 18:20 +0100
                Re: Writing passwords down <tomas@tuxteam.de> - 2024-12-18 19:00 +0100
                Re: Writing passwords down Jeffrey Walton <noloader@gmail.com> - 2024-12-18 19:20 +0100
                Re: Writing passwords down Frank Jezzer <etphonehomefrance@gmail.com> - 2024-12-22 17:30 +0100
              Re: Writing passwords down Jeffrey Walton <noloader@gmail.com> - 2024-12-17 23:30 +0100
            Re: Writing passwords down John Hasler <john@sugarbit.com> - 2024-12-17 20:30 +0100
            Re: Writing passwords down debian-user@howorth.org.uk - 2024-12-17 21:50 +0100
              Re: Writing passwords down Michael Kjörling <c9bc136c6063@ewoof.net> - 2024-12-18 10:30 +0100
      Re: a passwordless operating system debian-user@howorth.org.uk - 2024-12-17 12:10 +0100
  Re: a passwordless operating system Jeffrey Walton <noloader@gmail.com> - 2024-12-15 15:40 +0100
    Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 08:50 +0100
      Re: a passwordless operating system Jeffrey Walton <noloader@gmail.com> - 2024-12-16 08:50 +0100
        Re: a passwordless operating system Andy Smith <andy@strugglers.net> - 2024-12-16 09:00 +0100
          Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 09:10 +0100
        Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 09:10 +0100
          Re: a passwordless operating system Jeffrey Walton <noloader@gmail.com> - 2024-12-16 09:10 +0100
      Re: a passwordless operating system 🦓 <czyborra@gmail.com> - 2024-12-16 09:20 +0100

csiph-web