I agree, but remind that all your complex passwords are protected behind a SINGLE simple and "easy" password...
First of all, your single ONE password doesn't have to be "easy" - ever wondered why the application is called ONEPassword?
In fact, Agilebits tell you how to come up with a "strong" password.
But even if you choose a "weak" 6 digit password, there is still a HUGE difference if you keep your password file LOCAL (as I do, and as I would recommend to everyone else: only sync LOCALLY with your OWN Wi-Fi network - you never know what "Cloud Storage" will be hacked next...): The difference being that the attacker first needs to get PHYSICAL access to that file! And that means that they either have to hack your desktop computer and be able to extract the file from there, or get physical access to your mobile phone and hack into the OS (and you did at least set a 4 digit unlock code on your phone, at least did you?
).
Normally you'd store usually the SAME (or similar "constructed" passwords) on websites such as this one, MacRumors. Maybe you have a few "more secure" passwords for your more sensitive websites such as email servers.
But the point is: it is only a question of time until SOME of your passwords will be stolen by hacking into such websites, and since those are ONLINE it might only be a matter of running "scripts against a range of IP ports and see who's vulnerable"! Very different from trying to extract YOUR PERSONAL encrypted 1password file stored LOCALLY on your desktop (which hopefully is NOT reachable from the outside network - unless you're running your own Webserver, but then storing your 1Password keychain file on that computer would also be a risk that I'd avoid).
And there is yet ANOTHER reason to use software such as 1Password: password GENERATION!
If you think you've created a "secure" password "SucHAzTh1sOn3": think again! Basically if any of the underlying words can be found with Google, Wikipedia, the Bible or any other electronically accessible word dictionary: you're doomed!
Keywords: "substitution attacks": by cleverly substituting letters and digits, and also appending "pre- and postfixes" (birthday years, 123, ...) and much much more those programs manage to "guess" way over 50% of passwords (sometimes up to 80% and more!) within HOURS and DAYS, given a huge collection of encrypted passwords (which were stolen from some websites).
Here are some links about the "impossibility" to generate a "secure" password by yourself:
http://arstechnica.com/security/201...eling-the-next-frontier-of-password-cracking/
And this is how those "rule based substitution attacks" get fueled even more:
http://arstechnica.com/security/201...acker-group-now-has-1-2b-usernames-passwords/
After you have read that, tell me: what is more secure: trying to come up with "secure passwords" for every "sensible web service" for yourself (possibly having to change them in case those sites got hacked and come up with a COMPLETELY different password each time), OR: have those passwords GENERATED and MANAGED by a single application, and only taking care PERSONALLY that this file is not stolen by anyone else?
