8 million leaked passwords connected to LinkedIn, dating website (ars technica)

Then use something like oplop.

> That relies on being able to keep the data files storing all those passwords safe. And not just from outside threats but also hardware and software failure.

If a attacker has access to your user account then they have access to your passwords. It doesn't matter if you type them in, use encrypted store on a keyring, a spreadsheet on a truecrypt encrypted USB drive, ssh private public keys, have your browser store them, or use a plain text file at ~/.secret. If you use it and can access it from your user account then the attacker can access it too.

Really, though, using a password management mechanism of some sort is extremely advantageous. Once you stop needing to memorize your passwords it's very easy to use unique, long, and very random ones.

I use Revelation for that and have a few backups of the file on different systems.

I've downloaded Bruce Schneier's password manager, used a new safe password, added some passwords to the tool - and the next week when I tried to access it, I forgot the master password :-( The problem of rarely used password.

By the way, currently I need two passwords (disk encryption, login) on my windows laptop to get to a point where I can start the password manager. Life sucks.