Hello everyone, this is another security saturday. I have no clue how long it will be by the end, since I will talk about a simple concept: Paper backups.

And before you ask, yes that IS like writing down your password. Because why wouldn't you?

In the security community people say writing down passwords is a sin, but I would like to add some nuance. Writing down your password is a sin if you treat it like any other note you have. However, if you treat it like your credit card it should be safe enough for 99% of the cases. Maybe not so much if you work as a secret agent, but in general you should be fine. In fact, storing the password with your credit card would alert you to it's absence in the right way as well. Just make sure you also have a paper backup in a safe, so that on loss you can retrieve it from there and change your password.

Now, a paper backup is more than a password. It might have a few important password, but it should also have some phone numbers and some addresses. Depending on where you live maybe some satellite coordinates or compass directions as well. In any case, a paper backup should apply to you, and be kept safe.

The reason I am even thinking of a paper backup (and currently preparing one) is because of Mikko Hypponen and his keynote speech at Disobey 2020. It was either in that talk, or one that youtube suggested to me in lieu of watching it that he mentioned that during the ransomware attack on Mearsk everyone wished they had a paper backup like that. In fact, nowadays the people involved in the defense and recovery during the ransomware attack now have these paper backups of phone numbers and (probably) some other information.

I realized that if by some action of family or of myself I compromise one of my systems, I do want to have a backup. Actually, imagine my apartment catching fire for example. At night all my devices are in there, typically, so that would spell my own personal disaster. Having a paper backup in an easily accessible location (in my case, I have a survival backpack packed and ready always, because I volunteer at boy scouts anyways), or in a physically safe and distant location (bank vault, parents, children that moved out) or preferably both is a good idea for recovery.

Now the distant location need not be too distant, since you would need access to the phone numbers otherwise to coordinate a picking up of the information, so a local vault or locker service (or a fireproof vault at home) might be good options. Of course you could make it all more manageable and simply keep a metal punch-card or dog-tag not with your own information, but with the contact information of important people (that might or might not have a more extensive paper backup in keeping for you). This certainly would make it more manageable in the long run.

The other reason I speak about the paper backup is because the world becomes stranger these days, so I cannot help but think of ways a tech guy like me should prepare. Obviously there are more resources out there, but when you get too deep into it you become aware that many preparations rely on creating scenarios and predicting what will go wrong. I think that creates an unnecessary amount of stress. Just make sure you can get up and running when you get the chance, reaching the people you love and equipped with the tools you need. (Why yes, I do have a portable operating system on me now, I posted about that before. Also yes, this OS does have access to my password vault...)

Let me know what you think in the comments, and stay safe out there!