In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems absolutely inevitable that these sorts of leaks happen. It just seems like an incredibly put all your eggs in one basket cargo cult type move. I just can't stomach single points of failure like that for anything worth protecting.
Using a password manager is one of those infosec memes that gets oft repeated but doesn't make a lot of sense to me as being "more secure". To me it seems like your passwords existing outside of your head in any way is a risk, and to have them all in one place (even encrypted) seems way worse than having to go through the reset dance every once in a while because you forgot one.
EDIT: I was being a bit snarky and I apologize. As some commenters have rightly pointed out for the average person this is better than the uneducated alternative of using the same PW everywhere, and as method for reducing a random person's risk exposure it is extremely transmissible vs the alternatives.
That being said (as a commenter pointed out I should have included this in the post originally) I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. I don't think that these sorts of things are prohibitively complicated, and I think never storing passwords outside of your head has a lot of benefits. That's my personal approach and I think it's a better way to go.
P.S. A lot of the fault lies with requiring accounts for things that don't actually require an account. Another problem that comes out of the SaaS model which can be completely avoided by just not making SaaS.
Using a password manager is one of those infosec memes that gets oft repeated but doesn't make a lot of sense to me as being "more secure". To me it seems like your passwords existing outside of your head in any way is a risk, and to have them all in one place (even encrypted) seems way worse than having to go through the reset dance every once in a while because you forgot one.
EDIT: I was being a bit snarky and I apologize. As some commenters have rightly pointed out for the average person this is better than the uneducated alternative of using the same PW everywhere, and as method for reducing a random person's risk exposure it is extremely transmissible vs the alternatives.
That being said (as a commenter pointed out I should have included this in the post originally) I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. I don't think that these sorts of things are prohibitively complicated, and I think never storing passwords outside of your head has a lot of benefits. That's my personal approach and I think it's a better way to go.
P.S. A lot of the fault lies with requiring accounts for things that don't actually require an account. Another problem that comes out of the SaaS model which can be completely avoided by just not making SaaS.