way less convenient to generate dozens and dozens of unique, complex passwords. which means it’s less likely to be used/updated as much as it should be.
not tied into MFA which is an additional layer of security and convenience
Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.
And then, a human when a site doesn’t autofill, is more likely to just go “huh, weird” and do it manually.
Makes it harder: when I go to the wrong website, the manager simply doesn’t suggest credentials (it does not have) for it.
That causes me to wonder why.
Without a password manager, a user is never prompted to wonder.
They’d simply not notice.
You’ve always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something’s wrong and back away.
If you’re already used to manually typing in the auth details, you may not even notice you’re not on the site you were expecting.
Yeah, It’s actually quite a secure way to store passwords, since it requires physical access.
I knew a guy who had a drawer full of slips of paper with passwords written on. He called it the “security drawer”. Made me smile, but probably shouldn’t have been advertising it.
Here’s the thing … as crazy as a notebook with passwords sounds, it’s not accessible to someone across the internet.
but:
way less convenient to generate dozens and dozens of unique, complex passwords. which means it’s less likely to be used/updated as much as it should be.
not tied into MFA which is an additional layer of security and convenience
Please hold your password notebook in front of the laptop camera.
Password managers check the URL before giving its data. A human being can be fooled into giving it to a fake web site.
TBF, they can be fooled too.
Bitwarden warns against using autofill on load for that very reason, as then simply loading a malicious page might cause it to provide passwords to such a site.
And then, a human when a site doesn’t autofill, is more likely to just go “huh, weird” and do it manually.
Makes it harder: when I go to the wrong website, the manager simply doesn’t suggest credentials (it does not have) for it. That causes me to wonder why.
Without a password manager, a user is never prompted to wonder. They’d simply not notice.
Wait, what? How does autofill get fooled?
You’ve always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something’s wrong and back away.
If you’re already used to manually typing in the auth details, you may not even notice you’re not on the site you were expecting.
Just maybe don’t plaster “THESE ARE MY SECRETS” on the cover. Security through obscurity.
INTERNET PASSWORD LOGBOOK is probably a paper slip that you can remove, and then it’ll just be a blank leather journal.
Now a REALLY secure physical logbook would just have the cover of a boring, unremarkable-looking book on the outside.
Yeah, It’s actually quite a secure way to store passwords, since it requires physical access.
I knew a guy who had a drawer full of slips of paper with passwords written on. He called it the “security drawer”. Made me smile, but probably shouldn’t have been advertising it.
It depends on what the user fills it with.
Even the objectively safest solutions will be much shorter, and have less entropy, than what a pw-manager can deal with.
Their Ring camera that points directly at the desk they keep this notebook on: “it’s showtime”