I'm relentlessly difficult. So at the last job where I had mandatory password change policies I could have told you my previous passwords† and they were all just random gibberish. I think I had to change them every 45 days, and I had a total of six passwords, although only three of them had to be changed every 45 days.

However, I would also not defend mandatory password change policies, so you would never end up asking me :D

† I can't tell you now because the day after I ceased working for them I sent the nice leather-bound book I write passwords down in to my Product Owner, so that the answer to all subsequent "Do you happen to remember the password for...?" questions would be "Either it's in the book which you have or No". To be fair he only called me and asked that question once, which is why he was my favourite Product Owner, "capacity to learn from experience: 10/10".

Writing passwords down on paper is literally the primary reason password rotation isn't recommended anymore.

If something got a look inside your book, everything is compromised. At least by changing to another random gibberish password, an attacker would not get back in (in contrast to someone that increments a number, for example), but how much damage can something do in that time before you notice? How long do you think it takes a skilled attacker to install a backdoor (the answer is definitely less than 44 days)?

This is the second major problem with password rotation: it is false security. If credentials are compromised, immediately change them: don't wait 45 or 90 days.

If they're not compromised, changing them is basically pointless, because humans are going to human and either have an incrementing number, predictable pattern, or actual complex, random, unrelated passwords ... that they then write down.

Writing passwords down on paper is fine.

Writing passwords down on paper and leaving that paper in an insecure area isn't.

Your little address book full of passwords is the same as a password manager, and for a lot of people it's easier for them to manage the security of a booklet than it is to handle a password manager properly. And for those people, it's definitely worth using a book for the sake reasons we say using a password manager is a good idea

I do actually use a password manager (zx2c4's pass) to manage my own passwords. But my mother has a book I purchased for her as an Xmas gift one year, for exactly the reason you described, I am confident she understands the security properties of a book, (e.g. a stranger left alone in a room with the book can read it) whereas I have my doubts with a password manager.

I used a book for passwords issued by that employer because at that time they lacked any in-house password manager and I foresaw from the outset that I would want to be able to hand them "my passwords" in the limited context of that employment as distinct from stuff like my personal Wikipedia account, my Google account and so on.

That's correct, if bad guys broke into my home and accessed the book it would have been game over.

Personally I would be much more concerned about other things - my stuff is there, not to mention often myself - but I'm sure that a vast faceless corporation would be primarily concerned with the potential for these hypothetical bad guys to learn and maybe disseminate secret passwords.

How often do you think that actually happens? It's a bit... high risk for opportunistic "cyber criminals" don't you think? Figure out where key employees live, then break in and... look for passwords they've written down and then presumably use them quickly before they're invalidated.

If I have a paper book of passwords at a desk in an open office environment, sure, that’s bad. If I have a paper book of passwords in a locked safe in a house, and there is perhaps a large German Shepard and multiple able-bodied adults living in that house, I’d say my password book is relatively secure.

Besides, actually remembering your passwords is a security flaw, too. Memorable passwords are naturally less random, and if the password is in my mental memory, an attacker can compromise my password by smashing me over the kneecap with a heavy wrench until I tell them. If I don’t even know my password, that’s probably bad news for my kneecaps but slightly more secure overall.

"Actual actual reality: nobody cares about his secrets."

When my house got burgled, they didn't even bother taking my MacBook, let alone any real books. Your average burglar is looking for cash and items that can be quickly pawned, not corporate secrets.

If someone did break into my house as an act of espionage (corporate or nation state), I'd be worried about much more than just my password security.

You can improve security of the booklet with secret splitting: type the strong part from the booklet then keep typing "hunter2" from memory. The (strong) booklet part protects from machines, the (weak) remembered part protects from humans. Weak passwords are ineffective only against machines, they are still effective against humans.

I suppose that typing "****" on the end of your passwords would work. Bit annoying to type out 7 asterisks every time though, maybe a word would be better?

Write down your password. What's your threat model- Spies breaking into your house or some skiddie doing password stuffing?

Most of the people I know use some kind password they can derive if they forget it. Like their password for Company A will be the city the company was founded, city the founder was born, and the month/day it was founded. The ones who have to change it because of policy pick something iterative, like the first line of a song, then the second, etc.

Most of the people you know are well outside the normal then.

In my experience the average password consists of 1-3 words with some meaning to the user, sometimes either in 1337speak or followed by numbers/symbols if the password policy requires them.

I'm with you on this. I know very few people who generate passwords like that and most people I know use some simple "special word with special number" pattern. Often it's kids names, a random word they picked as a password years ago and have been reusing, and some part of their pin number.

In the past, I used a grid of random characters (a tabula recta) that I keep in my wallet, plus an algorithm for pulling passwords out of it. This system broke down when I was forced to change passwords on various sites.