What's worse IMO is that he says: > use some form of secure password vault on your phone [instead of writing them down] Writing passwords on a piece of paper

What's worse IMO is that he says: > use some form of secure password vault on your phone [instead of writing them down] Writing passwords on a piece of paper and keeping that paper in your wallet makes it impossible for a remote hacker to obtain your passwords from you. It is only against very powerful adversaries like the government or a targeted attack where this becomes a weakness. Compare this with storing your passwords in "some form of secure password vault". 1. A remote hack targeting thousands of people at once from the comfort of ones own home is now possible, any weakness in the vault can now be exploited en mass. 2. Instead of trusting that you can keep you wallet secure, you now need to: a. Trust the manufacturer of the phone b. Trust the supplier of nearly every IC to the manufacturer of the phone. c. Trust the author of the baseband processor blob (Broadcom). d. Trust the Android operating system e. Trust the modifications to the Android operating system on your device. f. Trust Google play services (which has root access to android). g. Trust that Google will not use it's privileged position in your phone to grab your passwords on behalf of any three letter agency. h. Trust the author of the password vault 3. To make the password vault any more effective than paper in your wallet, you need to encrypt the vault with a strong pass-phrase, and you are back to square one again. 4. The chances are that the average Joe that reads that and chooses to use "some form of secure password vault" will choose a bad one. The only reason to use a "password vault" if for convenience once you have too many passwords to write on a small piece of paper in your wallet or if you face a adversary where you expect them to be able to steal your wallet. In which case just memorize some 100 bit diceware passwords which is surprisingly easy.