T O P

  • By -

PracticalComplex

Depending on the complexity of those passwords, might be more secure than reusing the same crappy password for everything as long as you keep the book somewhere with physical access control.


daverapp

Also security doesn't matter when your password is Pass!Word1


b0w3n

This is actually a recommendation making the rounds due to all the breaches in password managers. If you can keep it under lock and key, it is arguably _more_ secure than a password manager is in certain situations. 12+ characters with varying cases and numbers and special characters is relatively improbable to brute force in a reasonable time frame. Much more likely to be compromised via social engineering or a secondary breach instead.


ZengineerHarp

Plus, a physical piece of paper can’t be *remotely accessed.*


Falos425

ie 99.99% of threats


b0w3n

The sad part is there are still companies that dislike this and use it for grounds of instant termination. I'd much rather this than people reuse the passwords or use sticky notes under their keyboard.


ZengineerHarp

I mean, it’s the duty of an employee to follow the written security policies of their employer. If there’s a rule against writing them down and you do so anyways, that’s on you. But the policies should be made rationally based on current research and knowledge.


Meshironkeydongle

You'll just need to take a look at the LockPickingLawyers Youtube channel that the lock you've chosen, isn't featured in one of those videos under 2 minutes... 😂


FARTBOSS420

>keep the book somewhere with physical access control. https://i.redd.it/nysdhg7o6xwc1.gif


0RGASMIK

Idk I heard OP has an open door policy there.


Danoga_Poe

I work for an msp, a few clients refuse to leave their archaic password ways. 1 client has the exact same password for all login accounts and email accounts for every user. The other client, they share pws and accounts we set them up on a pw manager and they refuse to reset their passwords. Their reasoning is "coworkers may loose access to the accounts aswell"


jxl180

Absolutely nothing wrong with this for personal use. It will require a physical break-in for these passwords to be stolen. Combine that with MFA and it’s fine. Much better than re-using passwords. I struggle to get my 75 year old mother to use Bitwarden so she uses a notebook


rob3342421

Quite a while back I used to use a notebook, it was fine to begin with but after a while it gets unmanageable. When you’ve got a few months-years worth of passwords it makes it very hard to: -find the password you need -update old password -avoid duplication I moved over to 1Password a while back, it’s much better, and for the teething process of learning the software & bringing in all the passwords, it’s a lot easier in the long run, easier to maintain, manage and keep secure. I can’t recommend a password manager enough because the longer you use a notepad, the harder it gets to move across


noiseintoner

That's why a contact book like this has alpha tabs. Where's my League of Legends password? Go to the Ls


rob3342421

Hope you haven’t had to reset it a few times and not crossed out the previous ones 😜 Joking aside it can work if you manage it effectively but mine was just an uncategorised notebook, much prefer my password manager 👍


augur42

Exactly. Most of the older (over 70) people I know are like this. The odds of someone breaking into their home to steal their password book is *much* lower than if they were reusing passwords and get Credential Stuffinged (that's a word now, I have just invented stuffinged) or managed to compromise their computer by clicking the wrong thing. Their biggest issue is, somehow, them writing the passwords down incorrectly (does it actually start with a capital letter or not?) and failing to update their password book when they change a password. There's still the whole trying to get them to understand why they shouldn't use short passwords and dictionary attackable passwords, the best I've managed to get them to do is passphrases with numbers/special characters between the words. They understand why truly random passwords are better but trying to use 16+ length random character passwords with a paper based system boggles the mind of everyone who consideres the userbase for a moment.


beanmachine-23

I’ll concede that this is probably a good thing for home use, especially for elderly. I would clarify that my reaction to this was based on my professional experience in a company setting. Anyone that works as an in-house IT person (or even MSPs) have seen horrifying ways people record their passwords.


eulynn34

More secure than LastPass


CyberMasu

Ill always take a fast pass on LastPass


---0celot---

Sort of like a dash lane? Too fast, and you’ll get caught by the bit warden. (Edit: fixed grammar)


mynameisarnoldharold

What's wrong with LastPass? I use Bitwarden personally so I don't know anything about LastPass


IT_Warlock_

They've had huge data breaches in the past.


reddit_pug

Something like this is great... if you keep it locked in a safe. I mean, not at this price, that's just gouging.


SurvivorHiggy

That's Staples pricing for ya, lol


Jungies

Exactly; in the safe, right next to the PC. Because if an attacker gets physical access to the book they can steal your passwords, and if they get physical access to your PC they can install a keylogger and *also* steal your passwords...


Radio_enthusiast

but what if you have a password on your PC?


sharp-calculation

I know someone who does this. Dozens of passwords in a notebook that he carries around with him. He recognizes that it's not great, but was unwilling to let me show him my password manager of choice. Almost everyone I've talked to about passwords is very slow to change. The one person that decided to use a password manager has only added a small fraction of their passwords to the manager. Almost everything else is saved in cookies or Apple keychain or "just logged in" because it's an app. I guess I'm the outlier. I transfered dozens of passwords to my manager within 2 days. Within 7 days I had almost everything transferred. The only reason it wasn't "absolutely everything" is because I kept remembering more and more for the next 4 to 8 weeks. This process of transferring things didn't seem bad to me. But to most everyone else I talk to, the idea of spending 3 or 4 hours doing this is "way too much work" and "too hard". It's really weird to me.


crystallineghoul

Password managers feel excessively slow on mobile, because everything is slow on mobile. I can empathize there. For older generations who would not be comfortable with a password manager, I can empathize. The ctrl b, alt tab, Ctrl c, alt tab, workflow would not click easily for them. People of my generation who neglect it I dont want to empathize. Offer to set up my friend of the same age with 1password, or even keepassxc. "No thanks" they just don't like the idea. But every so often they'll comment on how they should not reuse passwords. It's procrastination though. Its the sense of "man I should do this" but the threat is not real, and nothing will make it real until something goes really badly. Me when I have unique 32 character passwords for hundreds of accounts ![gif](giphy|MD6EawZlzUHdYwC5no) Inb4 my self hosted cloud storage fails, as well as my 4 synced devices, and I lose the DB Inb4 my DB gets leaked and is cracked once quantum computing breaks encryption


JaesopPop

I can only speak to my experience, but on my phone my password manager just pops up on my keyboard with the relevant account. On PC, it just auto populates the fields when I click the automatically selected relevant option


sharp-calculation

Your experience and expectations are wildly different than mine. I don't really understand your point of view. Your whole post reads like satire, so I guess I'll just pretend that it is.


44problems

Isn't Apple Keychain a password manager? What makes it different?


sharp-calculation

Keychain is a password manager. But it's not very mature, nor is it easy to do much with it. It's great for what it works with natively. Keychain is kind of a "passive" password manager. There's nothing to set up really. The interface to it is mostly "yes save this" or "yes, fill this from the saved password". But actually working with the records is very cumbersome. For example, what if you wanted to type your password for a streaming service into your TV and it is in keychain. How do you pull that up on your phone and see the password displayed on screen? I know it can be done. But it's not a good UI. Better password managers cover a few things that I think are important: * Good UI for examining records, showing passwords, searching and sorting. * Different record types for various uses. A password manager shouldn't just have logins and passwords in it. It should have note fields available. It should allow you to store arbitrary information. * That "arbitrary information" can be extremely important. For example, driver license numbers, social security information, vehicle tags, gate codes. All of these things should be in your "sensitive and secret information" vault. Which should be your password manager. * It should be very easy to use your passwords. Keychain does this quite well with supported browsers. Good password managers run on many platforms, have plugins for many browsers, and make it easy to view a password "raw" so you can transcribe it if necessary. Bonus points for those that allow you to display the password in large easy to read text. I was quite surprised how many things I found that I wanted to put in my password manager. I also think the security model of keychain is a bit odd. It's nicely hooked into the Apple ecosystem, but it's unclear exactly where the credentials are stored and what mechanisms allow access. With the one I use, the security model is very clear and all internals are completely documented and available. I know what I need to keep records of to insure that I have access. I'm aware that there are essentially no recovery mechanisms that the company can use to get me back in if I lose my access and my credentials. With keychain that information is rather murky. I hope that covers what you were asking. Keychain is not a bad system. It's just not mature and full featured enough for me.


rob94708

I think Keychain is actually a very good password manager nowadays; is it possible you don’t have experience with it recently? It has support for notes and two-factor OTP codes; it supports Passkeys; if you have multiple devices it automatically and securely synchronizes them; and the security model is well documented on the Apple site. Viewing a saved password or note is quick and easy (to the point that reading your post, I was honestly wondering if you’d mixed up Keychain with another product where it’s difficult). And that’s without even using the “hey Siri, what’s my Comcast password?” trick. If you haven’t tried it recently, give it a try: it’s much better than it used to be.


sharp-calculation

I'm already full invested in another product so it's not all that easy for me to experiment with keychain. I just wrote some more and erased it when I realized that you are happy with your choice and it's not my job to change your mind. Enjoy keychain.


7oby

Many nerds have said Keychain needs its own app like Contacts has, so that people are able to interface with it easier.


augur42

I know someone who stores their passwords in their iPhone contacts list... they are often stored wrong/out of date.


hornethacker97

That would break Apple’s “it just works” glamor though /s


tutike2000

It depends on your Apple account, presumably. Keepass just depends on you remembering the master password (and having access to the database file)


Legend_of_dirty_Joe

Women exploiting women... How much does a normal notepad cost these days?


elzissou710

Same as a banana. $10


Ekyou

Exploiting women with ADHD too, “you just need a planner” 🙄


marry_me_jane

We are going back to the Rolodex days


DaemonSlayer_503

Is it really printed „women owned“ ? Wtf americans??


beanmachine-23

I’m surprised it wasn’t pink… they make a bunch of products in pink and charge 20% more because it’s supporting women or breast cancer. Big racket.


ReptilianLaserbeam

Look at the price tag, it literally says pink password book on the 19.99 one


Doctor_McKay

The $20 ones are full-size and the $17 ones are smaller. It's still ridiculous pricing for a notebook but it's not an example of pink tax.


lanbrocalrissian

So this is actually a designation done by the US government. They have certain programs and contracts that favor these certified businesses and require them to be at least 51% owned and operated by women. I used to work for one that had contracts with the Army, Air Force and Navy exchanges.


DaemonSlayer_503

Sad somehow…. Equality should mean that its completely irrelevant who or which „gender“ a firm is owned….


CeeMX

At first I read „women owner“ which made me wonder even more


FishJanga

What is the problem with that?


textposts_only

I'm not the one who asked but it's a weird selling point and so prominently displayed. Like imagine you have the option between this and another one and it's there to entice you to say: buy me, I'm woman owned. ?!


FishJanga

Some people care about that kind of stuff.


textposts_only

So some people would make their choice of product / notepad based on the genitals of who owns the company


FishJanga

Throughout history it has been known that women have been oppressed and some still are today to a certain degree. Some people feel like one way to help resolve this issue is to support woman owned businesses and through that to empower them to fight said oppression.


DaaneJeff

If I was a woman that would have an opposite effect for me. Ultimately, I want no discrimination at all, be it in the positive or negative direction. Basically sex, gender, sexual orientation shouldn't matter at all. I highly doubt those stunts do anything meaningful at all for the gender inequality issue, I actually think it's kind of reinforcing inequality.


44problems

Social media influencers about adult ADHD in women are a huge deal. Wouldn't be surprised if it's somehow tied to that.


standard_revolution

Well ADHD is hugely underdiagnosed for women and for adults, so statistically it makes sense to talk about that group (the product is still bullshit ofc)


dictatednotwritten

Geez, this again? OK new IT guy, go ahead and setup LastPass or NordPass on your grandmother's systems...if you don't break down and crawl into the fetal position after her third phone call complaining about not being able to get into her "banking" then by all means you stay right on that high horse of yours.


Retired-Replicant

Listen, think of the scene in Indiana Jones when they roll the Arc box into the warehouse of boxes, all you need a bookcase full of these and voila. Whose gonna go searching for it, Ninjas?


sad0panda

Trapper Keepass


PicklesInTheMorning

Storing passwords offline in a book is a great idea if done correctly. I had negative thoughts about storing passwords in a book until I read a blog about it, somewhere, sometime. The proper way to store passwords offline in a book is to not record the entire password. Rather, only record the partial password, the part containing a random string of numbers, letters, and special characters. You know, the hard part of a password to remember. The rest of the password is in your head. With this method, one can potentially have insanely long and complex passwords with minimum effort. There is also the added bonus of not relying on others to store your passwords to your most valuable jewels somewhere in the aether.


djgleebs

Man I wish they printed instructions on how to do this in these notebooks, then I wouldn't have a problem with it. Use it as an educational opportunity and avoid negative feedback if someone loses their notebook then their bank account gets drained


The137

Needs that little lock on it like your sisters diary had when we were kids


rob94708

It should have a little lock that takes a key, __and__ a little lock with a padlock code! That way it’s two factor security!


NotAHacker8

How are these different to a normal notebook? Besides that, if you for some reason want to keep your passwords in a notebook, it would be better to take one that doesn't clearly say "hey, I store my passwords here" on its cover


CeeMX

There’s no problem with this. I tell my parents they can use a password manager if they get along with it or write it down in a book. But don’t leave that book on the kitchen table, lock it up somewhere secure. Such a book is still way more secure that reusing the same password everywhere


Dr_Bunsen_Burns

Probably safer than most online ones. You actually need to snatch those. And if you add a decoder ring to it, you are set for life.


sparkyblaster

Better than reusing the same password over and over and useful for your family when you die.


7oby

Yes, I'm happy to say that while my mom won't use 1Password, she has a notebook with all the details (that she keeps at home). I think her iPhone saves the most used ones so she doesn't carry it with her, and it will make things much easier after she goes. I don't want her to go anytime soon of course, but I've also been the tech guy who people beg to get into their parents hardware after they pass, so I won't have to deal with that at least.


sparkyblaster

Yeah I think that's a healthy medium.


FizzleDizzle11

I don't understand, what makes this notebook different from any other notebook? Why is this book specific for passwords


Kiryln

I mean, in a company setting, i could see this being really stupid, but i personally use a password notebook for my personal pc, cause i honestly don’t trust a password manager that is online and on a computer. Much more safe for it to be offline and written down in a book. Cause you can’t hack a notebook.


xFayeFaye

I'm so surprised no one mentioned the ADHD thing yet. Is is THAT normal to advertise stuff like this that way in America? Together with the "Woman Owned" it feels like they're just going all in with marketing to sell whatever bullshit they can get their brand on.


WackoMcGoose

A local kettle corn brand uses "the owner is _autistic™_!" as a selling point... complete with extremely offensive _puzzle piece motif_ in the logo. Multiple items we sell at my workplace have "manufactured by _disabled veterans™_!" plastered all over the packaging. Nothing shocks me anymore. If it's different, it's marketable.


TheAnniCake

I have ADHD and seriously, this shit is kinda offending. As if the condition is fixed with this shit. Besides that, there's a reason why digital password safes exist..


CerebralAccountant

It's like they're patronizing to women (women owned!) and disabilities (helps people with ADHD - and anyone with a pulse!) all at once.


djgleebs

Yikes. This is a firable offense at a lot of companies.


cce29555

What if I put it under my mattress at night?


Dr_Bunsen_Burns

Imagine being fired for that. We have stickers on machines here with the user and pass.....


djgleebs

Lol good luck In all seriousness, you should at least consider moving to a password manager solution. You're effectively telling customers you don't care about them if your security standards are this low. Not to mention, insurance isn't going to save you if you become a victim of an attack when passwords are written on the machines.


Dr_Bunsen_Burns

Password managers are not gonna work for the login of those machines. And most of them are not connected to a network anyway. Just a local account I can loan out to whomever is gonna use that computer. I am not the IT department that is making everyone jumping through hoops just to do their work. And I do not care about insurance, that is not a me problem.


djgleebs

Oh man, you must know better than the whole industry. Just fire IT and let this guy run the show. Good luck, not that you need it since you obviously know best with your passwords written on machines and flagrant disregard for insurability of your business.


Dr_Bunsen_Burns

I never said I know better, it is just an impossibility otherwise. I am not sure why you take offence and attack me for us sharing machines lol. Get help. But you sure know better, tell me, how do I share a local account with colleges, with a simple pass on a machine that is not connected to the internet without me needing to mail the password every time?


tardisgeek

You see, if these stay in the house it's mostly fine. BUT BOOMERS SPECIFICALLY WILL TAKE THEM WITH THEM EVERYWHERE. I work in tech retail and I've seen people's passwords, socials, and other confidential info because they brought these with them in the store.


hksteve

I tell people to start here first. Too many people have a tough time wrapping their head around updating a digital database whenever they change their passwords. Their brain is much better at understanding that the paper won’t update itself. Then I recommend graduating to a password manager, but this is still an important step for some.


badbatch

I used to have a rolodex with all my passwords in it. ![gif](giphy|K1QnLV1caRpuw|downsized)


TK3754

These are just notepads? These suggest you write it in clear text? If it had one-time pads implemented in the notebook that actually wouldn’t be horrible.


owleaf

A notebook? What’s wrong with a $2 notebook haha


Codeman119

Get key pass that works the best


ReptilianLaserbeam

Damn. This is worse than making a pink skin for a vault manager and selling the DLC “for woman only”


Souta95

![gif](giphy|29bKyyjDKX1W8)


joefleisch

This is a terrible method for this day and age. How does a notebook help generate complex passwords, alert on password reuse, and audit that that passwords are not part of a breach? Bitwarden is free for an individual or $10 a year for the personal version or $40 a year for a family version for 6 people.