http://www.theregister.co.uk/2005/07/19/password_schneier/
By John Leyden
19th July 2005
Security guru Bruce Schneier has backed calls from Microsoft's Jesper
Johansson urging users to write down their passwords. In years gone by
scribbling down passwords on Post-It notes was often cited as a top
security mistake but the sheer volume of passwords people are obliged
to remember means people often use easily-guessed login details,
another security faux-pas. Schneier - well known for his original
thinking and ability to apply common sense to security issues -
advocates a low-tech solution to the password conundrum.
"People can no longer remember passwords good enough to reliably
defend against dictionary attacks, and are much more secure if they
choose a password too complicated to remember and then write it down,"
Schneier writes in his latest Cryptogram newsletter.
Using a password database (such as his own free PasswordSafe utility)
is one option. But Schneier is also enthusiastic about a much more
low-tech approach - think of difficult-to-guess passwords, write them
down and keep them on a bit of paper in your wallet.
"We're all good at securing small pieces of paper. I recommend that
people write their valuable passwords down on a small piece of paper,
and keep it with their other valuable small pieces of paper: in their
wallet," he writes.
The technique could be modified for a little extra security. "Obscure
it somehow if you want added security: write "bank" instead of the URL
of your bank, transpose some of the characters, leave off your userid.
This will give you a little bit of time if you lose your wallet and
have to change your passwords. But even if you don't do any of this,
writing down your impossible-to-memorize password is more secure than
making your password easy to memorize," he concludes. ®
_________________________________________
Attend the Black Hat Briefings and
Training, Las Vegas July 23-28 -
2,000+ international security experts,
10 tracks, no vendor pitches.
www.blackhat.com
