[DanBC]

The strong password has value. Credit cards and cash have value.

Write the strong password on a credit card sized bit of paper, and keep it in your wallet.

People tend to keep their wallets safe.

Most people can learn complicated passwords after a few days or weeks of use, so you can keep the paper in a safe place at home once you've learnt it.

[ricardobeat]

Worst advice ever. Now you only need to lose your wallet and you're in the same situation as the article's. The old advice is still sound.

[nl]

A random string of characters in a wallet doesn't have a lot of value. Of course, don't write down what that string is for, and make sure you have another copy at home. If you are really concerned, leave off the first character of your password and remember that.

The truth is that 2-factor authentication is the real solution. But one has to make do with imperfect solutions

[DanBC]

No.

Writing your password / passphrase down allows you to chose a good, strong password. You do not give anything that links that password to a particular service.

Most people will only need to refer to the written password for a week or so, and then they will remember it.

You put the piece of paper in the wallet because you want people to treat it like a 50 dollar bill. People leave bits of paper anywhere, but they don't leave 50 dollar bills everywhere.

Not writing down the password? Yeah, we see how well that works. (https://www.google.co.uk/search?q=most+popular+passwords)

It is baffling to me that authenticating to computers, software, and services is still so weirdly broken. Especially since there is now billions of dollars involved in it.

[ricardobeat]

You don't need to link it to any particular service. There is a 99% chance the person has a gmail/facebook/twitter/live account.

[DanBC]

I know that you're not suggesting that people should reuse one password across multiple services. In your model:

1) I have to lose my wallet and

2) Not change my password and

3) You have to know my login email address and

4) You have to find which service the email and password work for

...and all of these have to happen in the time between setting a new strong password and learning that strong password. Because when you've learnt the pass you stop carrying it around.

If you lose your wallet there's a bunch of stuff you need to do. You need to cancel your cards, for example. Keeping a single password in there (for the short time it takes you to remember it) means that there is one more step added - you need to change that password.

You're also failing to do a sensible risk analysis. The threat model for passwords is "hackers, anywhere in the world". The venn diagram of that very big set has a teeny tiny intersection with the much smaller set of "people who have access to my wallet if I happen to lose it".

Writing down a good password means that you get to use a good password. You get to choose a properly strong password, with many characters of mixed case including numbers and specials; or a 6 word passphrase.

[cheald]

If you label the passwords you're probably doing it wrong. If someone pulls out a piece of paper that says "QWhXnLv0qzi1h1m" out of my wallet, how are they going to use it?

If you're worried about someone stealing it, just shift the password over, so it's now "mQWhXnLv0qzi1h1 > 1" on paper.

[ricardobeat]

Any tech savy person knows that has a strong possibility of being a password. Grab an ID, google "your name gmail", log in.

The kind of weak encrypting scheme you can remember is easily defeatable, this is still very vulnerable even if you leave one or two letters off (which you'll have to remember in addition to the scheme). So, going back to the parent, no, this isn't safer than a password in your head.

[petitmiam]

but this isn't the password for gmail. This is the password for the password manager account. So you need to know the password manager they are using and the username to match with the password. They have to find this out within the time that we've realised we have lost our wallet and are changing the password.

Obviously this is still less secure than no password in the wallet at all, but I don't think it's "very vulnerable" as you are claiming.