Bdtyk

A lot of the users in my company are using their agendas to write down their password and usernames, or Excel sheets with a protected password. I'm hesitant to install software for password management after reading recommendations/feedback on them. Is there any other secure and user-friendly solution to store passwords?

Install a password manager. A good password manager is much, much better than anything you can do by yourself.

They are software created by security professionals, follow strict development rules, and are tested by a lot of people, and attacked by a lot of people. They have better chance of protecting your passwords than anything invented by the average, even the above average user.

You're probably referring to the recent articles about flaws in password managers.

• 
  Password managers have a security flaw. But you should still use one. (Washington Post)


• 
  Password managers leaking data in memory, but you should still use one. (Sophos)

Its right there in the titles, password managers have flaws and you should still use one because they're more secure than what many folks do, like keeping passwords in Excel, emailing them around, pasting them into chat where they'll be logged by everyone...

All software has flaws. Password managers, and security software in general, is held to a higher standard than run-of-the-mill software. The flaws these articles are talking about in password managers are not rookie mistakes, but risk trade-offs.

1Password has a write up about the latest flaw. It's not a mistake as it is a consequence of a trade-off to avoid other worse memory bugs. The important bit is that your computer must already be compromised and you have recently typed in your master password. If your computer is already compromised, keeping your passwords in an Excel spreadsheet offers you no protection.

Password managers can do other things to add to your security.

• Share and manage your passwords between all your devices, including mobile devices.


• Share and manage passwords and credentials with co-workers.


• Store more than just passwords securely.
  
  
  
  
  • GPG and SSH keys and passphrases
  
  
  • 
    One-time password generators
  
  
  • Recovery keys
  
  
  • Security questions
  
  
  • API keys
  
  
  • Notes
  
  
  
  


• Inform you of insecure passwords
  
  
  
  
  • Reused passwords
  
  
  • Password breaches
  
  
  
  


• Generate secure passwords


• Auto-fill passwords (avoids being shoulder surfed)


• Auto-record new accounts

These avoid bad practices such as reusing passwords, using weak passwords, sharing them via email or chat or a shared document, writing them down (whether on paper or a file), and continuing to use breached passwords.

Your only solution is to select passwords, that are hard to break but easy to remember, then you don't need to write them down anywhere!

But seriously, maybe you can ask your IT support to install a password manager server for your whole company, then you don't need to install one on your machine.

The safest place to store a password is nowhere. It should be a secure token that only exists in the memory of the holder. Unfortunately, many use a password that is too simple and insecure, for the purpose of making it easier to remember. In contrast, more secure passwords are more difficult to remember (for most people).

If you cannot rely on your memory, you should definitely use a password manager. Password managers prevent even physical access from compromising your passwords. A little physical password book is only as good as the lock on your door, which is far less secure than a master password for a password manager that's stored only in your memory.

If you do not want a password manager program, print them out and store then in a safe or something secure rather than just a notebook like your co workers use.