http://www.theregister.co.uk/2005/07/19/password_schneier/ By John Leyden 19th July 2005 Security guru Bruce Schneier has backed calls from Microsoft's Jesper Johansson urging users to write down their passwords. In years gone by scribbling down passwords on Post-It notes was often cited as a top security mistake but the sheer volume of passwords people are obliged to remember means people often use easily-guessed login details, another security faux-pas. Schneier - well known for his original thinking and ability to apply common sense to security issues - advocates a low-tech solution to the password conundrum. "People can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and then write it down," Schneier writes in his latest Cryptogram newsletter. Using a password database (such as his own free PasswordSafe utility) is one option. But Schneier is also enthusiastic about a much more low-tech approach - think of difficult-to-guess passwords, write them down and keep them on a bit of paper in your wallet. "We're all good at securing small pieces of paper. I recommend that people write their valuable passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet," he writes. The technique could be modified for a little extra security. "Obscure it somehow if you want added security: write "bank" instead of the URL of your bank, transpose some of the characters, leave off your userid. This will give you a little bit of time if you lose your wallet and have to change your passwords. But even if you don't do any of this, writing down your impossible-to-memorize password is more secure than making your password easy to memorize," he concludes. ® _________________________________________ Attend the Black Hat Briefings and Training, Las Vegas July 23-28 - 2,000+ international security experts, 10 tracks, no vendor pitches. www.blackhat.com
This archive was generated by hypermail 2.1.3 : Tue Jul 19 2005 - 22:59:10 PDT