Thou shall take care of the password manager, as it is a single point of failure. Because users (=not people who read and understand news from hnews, but the la

Thou shall take care of the password manager, as it is a single point of failure. Because users (=not people who read and understand news from hnews, but the layman): 1 - won't make backup of the password manager (PM) database 2 - will forget sometimes the main password of the PM 3 - will loose the cellphone where the PM is installed 4 - will not update the PM 5 - will tell somebody else the PM password And there will be many PM, some will have flaws, bugs or backdoors. Some will work on iOs but not on Android. Some will mess up in same point and make users lose trust. And there will be sites with bad interface that won't accept copy-and-paste of the passwords. That will require things that your random-generated password doesn't contain. Will complain about something that it contains. Will do good on the password but will have those stupid questions (maiden name? grandfather name? pet name?) that you'll be able to find in any Facebook. Than the weak point becomes the password recovery. I just found one type of requirement that was good enough to people take real care with the password: when the password is the one that allows anyone to withdraw cash from their account. When there is real money in the game, people take care. Edit: misspelling, thanks for the warning!