Posted by Anthony Knights on 03/06/2021 08:44:29:
My Password Manager is an A5 ringbinder. Keeping passwords on the computer is a bit like leaving the keys for the safe in an envelope on top of said safe.
An Ringbinder is only as secure as whatever protects it, basically useless if the house is burgled. Ringbinders aren't secure in themselves. Locking one in a safe hidden under the floor would help!
Hacking computers is more difficult than housebreaking, and even if the operating system's login/password is bypassed by physically removing the disc and reading it with another computer, a password manager is still safe because it's contents are encrypted. To get the passwords it's necessary to break the password managers cypher, which in any half professional product will be seriously difficult. Not a paper and pencil job.
Note that removing a disc and mounting it on another computer allows the new computer to read everything on the disc that's not encrypted, which is why Nigel's spreadsheet isn't secure. Safer if he encrypted it, but spreadsheet encryption may be weak.
I don't use a password manager! Instead, one of my various notebooks contains passwords disguised in aide-memoire form and scattered amidst other information. The passwords are a random mix of letters, numbers, and punctuation at least 8 characters long. Login names and passwords aren't stored side-by-side in the book, so it's not obvious what the aide-memoires refer to. Not strong enough to defeat a government agency determined to crack the system, but too difficult for the average crook, I hope!
It's about striking a reasonable balance between risk and cost. There's no point in protecting a computer that doesn't contain sensitive information or do online banking or shopping. But don't be naive either. If the computer contains anything of value, protect it.
Dave