Password manager vs. my memory palace: I finally switched after 12 years
For 12 years I used the same base password with tiny changes for every site, and I thought I was being smart. Then a guy at a security meetup in Denver told me about a site called Have I Been Pwned, and my main email showed up in 4 different breaches. Now I use a password manager with random 20 character passwords, but my brother says that just gives one company all my keys. So which is riskier: my old habit or trusting a single app with everything?
Oh man, I heard a podcast about this exact thing last month and the guy said the real danger is password reuse, not the manager itself. He said when one site gets hacked, your login gets tried on a hundred other sites within hours, which is how people get wrecked. He also said most of the big password apps never actually see your passwords because they get scrambled on your own device first. So yeah, your old way was way riskier, and your brother is kinda wrong on this one.