I have dozens of credentials. It would be hard to remember them all. It gets even harder the more the passwords are safe (longer, bigger character set, random). Password managers allow me to use very long passwords with a big set of characters (depending on what the service allows). Also passwords can be random which basically leaves attackers with brute force only, e.g. wordlist attacks do not make much sense anymore.
Also the human brain is definitely not the most safe place. People forget things every day. Especially stronger passwords are harder to remember as I said already. Passwords that you did not need for a longer period can also be hard to remember. Also something unpredictable can happen like a car accident. Good luck trying passwords when you wake up from coma. Even if this is a special case it is just an example to show that the brain is not safe.
I personally would not store passwords on a service not under my control even if they are encrypted. The encryption might now look solid but that may change in the future. So ciphers should be evaluated with the duration of their usage in mind. For some people this might be okay, but not for me.
Anyway I think FLOSS password managers are the best way to handle passwords. I never tried it, but I think some of them let you print passwords for offline backup.
I’m happy with bitwarden, and honestly to remember the dozens of passwords, especially if you want longer, difficult to guess, passwords, it becomes next to impossible to me.
I think there are two different meanings of “safe” being used here, depending on what is most important to protect against - stop someone else getting access to your stuff even if it means stopping you yourself getting access to your stuff v. balancing those two risks.
If you are a dissident in a totalitarian country then you could easily go for the former - and you wouldn’t want a paper copy in a locked container.
So you argue that a password is unsafe if literally no one knows it or how to get it? I can’t see how you would logically arrive at that conclusion.
That notwithstanding, I was making the point that if even authorized access is prevented, how can unauthorized access not be (in the context of the human brain)? Hence my facetious post.
I’m arguing that a person could reasonably use such a definition because the implied Denial of Service (to yourself) is itself a cost and a risk, and a failure of security.
It depends on what is most important.
What you call “safe” depends on what cost / risk you ascribe to someone else being able to access your stuff v. what cost / risk you ascribe to losing access yourself to your stuff.
Oh I see what you’re saying. I can’t honestly agree, but the reasons are semantic in nature and not worth either of our time. Plus I don’t actually want to be taken seriously when I say that the brain is the best place to keep your passwords because you can forget them.
you can store passwords in plain-text (digitally or printed) if you use a secret formula to generate the actual passwords/passphrases from that plain-text input.
say you take :
foraarethebestwaytostorepasswordsinplaintext
and after you apply the ‘secret’ algorithm you get
Passwords could be safe from being lost or secure of unauthorized access. I am not sure if you can get both to 100% but you could get both to a certain degree. E.g. if you trust your family members you could make a printed backup of the password manager’s DB and put it in a firesafe container. That way your PWs would be secure against remote attacks and safe against fire and neuronal problems, but not against thieves. You could use a tresor / safe but than you delegate the problems.
You could build false wall in closet or hidden space under floor to put fireproof safe. Even inside drywall. So thieves cannot find it. If you’re always home, thanks to coronavirus, you could order alarms, improve security around your home that you get notified when anyone enters. Garage door locks that cannot be opened from outside, same with doors, sliding doors, windows, etc.
I do not trust wifi or network security like Amazon’s Ring, or ADT, indeed some serial killers are known for working at ADT. I have panel for my garage door outside, I use disinfect wipes to wipe it off after using. But it cannot work when I use latches to lock my garage door from inside. But if you go on travel, you might need someone trustworthy to watch or keep on checking your home. Or spend a lot more money to make your home more difficult to break in, like rolling security grilles for your windows and doors, more or better locks, etc.