I guess that's kinda fine, but there are at least two reasons to not do this: - Access to any of your accounts could make impersonation easier. You might not b

I guess that's kinda fine, but there are at least two reasons to not do this: - Access to any of your accounts could make impersonation easier. You might not be the one who suffers from whatever they do. Or if they can assemble enough PII, you might unexpectedly have a line of credit taken out on your name. - Many websites use some form of federated login, or a crossover kinda situation where you have a username/password login that is linked to eg a Google account. Access to the username/password account could open you up to an attack on the juicy targets. Personally, I'd rather none of my accounts are easily compromised, but that's a pipe dream - it's not up to us to secure the services we use. So best thing to do is just use a good password. It's easy these days to use a good password, though I acknowledge still tedious/impossible to update all of your services.