What I found interesting is go to the (ref) for his advice of writing down passwords, which is a 2005 blog post from Bruce Schneier. His advice seems obvious and correct even then, but just scroll through the comments and see the terrible password recommendations people were giving back then:
> Why not just use a combination of words and numbers you can remember, and mix in some 7331 speak? I find this to be easy to do. Example Th0M42Y0rk3
> one recommendation I heard a while back was to mix in other information into the passwords when you write them down…like your phone number or driver’s license number or address, etc, etc – stuff you know very well already…
> One of the most interesting ways that I’ve heard of to create strong passwords is to use a pattern of keystrokes from your keyboard, i.e. a circle of all the keys around the ‘F’ key for example, or an inverted V starting at the ‘x’ and ending at the ‘b’.
> This is great timing… I just gave a security awareness presentation where this was one of the topics. My advise was to take a short phrase, do some creative (i.e. non predictable) substitutions and use that as your password. Then you can write down your phrase as a reminder without revealing the password.
It seems like security experts spent a tremendous amount of effort to try and prevent people from writing down their passwords, then the world changed so much that "your attacker achieves physical access to your wallet and steals your passwords" was not a significant threat to most people any longer, and everyone had to reverse course.
In my opinion, not having to remember passwords allows you to have so much more security against attacks that are actually likely to affect you (database leaks, rainbow table attacks, dictionary-based cracking methods, etc.) that it is well worth the trade-off of having to secure your piece of paper. A modern password manager is another good variant of this method.