--- nav: Why title: Why do I need it? order: 1 layout: default ---

{{ page.title }}

Passwords are frustrating.

We all struggle so hard, trying to keep our accounts secure.

But we're admittedly terrible at it, and what's more, we really don't want to have to bother with it.

There's a lot of noise about passwords lately. Accounts of popular people and friends alike getting hacked. Huge data leaks have become common news. And every time we're reminded of our need to be good virtual citizens — keep good passwords, use unique passwords for every site, nothing predictable or simple. How do we keep up?
And even more importantly so, how do we keep safe without sacrificing our freedom for that safety?

Do you really have passwords?
Or does something or someone else have them for you?

Where do you keep your passwords?

Go ahead, select the box that represents your current approach to passwords.

Let's consider a few important questions you may be asking yourself.

The password notebook.

Have you considered?

  • What you'll do if you don't have your book with you?
  • What if it's found by people you cannot trust?
  • How easy it is to take a picture of the pages while you're not there?
  • What might happen if the book is damaged (eg. coffee spill), lost or stolen?
  • How often do you find yourself copying passwords out onto other notes?
  • Do you keep a backup notebook?
  • Are these actually strong passwords?

The vault in an app.

Have you considered?

  • Can you still use a computer that doesn't have your app set up?
  • Are your passwords synced over to your many other devices?
  • What companies now have access to all of your secret information?
  • Do you need to be worried about news of a large hack on this company?
  • What will you do if you lose your device, or don't have access to it?
  • Are you well protected if a virus or person copies your vault?
  • On a trip, could a foreign officer confiscate your device and compel you to unlock it for them?
  • Are these actually strong passwords?

The privacy of memory.

Have you considered?

  • You might forget passwords you haven't used for several months or years?
  • Do you use shared passwords across different accounts, thereby hugely increasing the attack surface of these passwords?
  • Are each of your passwords sufficiently random or variations of a theme?
  • If someone tricked you into signing up for a fake site, could the password you gave help them get into your other sites?
  • Do you find yourself using helpers such as sticky notes?
  • Do you have a backup plan in case your memory gives out?
  • Are these actually strong passwords?

A password is something you know,
not something you have.

You walk up to the entrance of an invite-only night club.
At the entrance, a large man, thick leather vest, stops you in your tracks. Password, please?

Passwords are secrets which we are expected to remember. Writing passwords down is highly frowned upon — and rightly so. The secret leaves your head and is out in the open. It's like confiding in your friend, and then she goes and puts it in her diary, which anyone could find.

Things we have — car keys, a badge, the garage remote — are things we can lose or get stolen. We need to keep them safe, protected and always on-hand. This is a real hassle, and we don't want that headache for our dozens of passwords.
Things we know are things we can keep secret, they are locked away safely in our head where none can get to them.

And yet, we are now expected by websites everywhere, to make and remember secret passwords for each of them, while also making them non-personal and unique? This is intolerable. No wonder many of us defect and write our passwords down wherever we can — often in the form of digital notes or password "vaults".

But this is a panicked reaction to a problem we simply don't know how to handle:
The problem of passwords for everything.