When the topic of computers comes up between friends/family, the topic of security is not too far behind, and I always mention I use KeePass in addition to long and complex passwords. I'm often met with laughs and the absurd question of Why?

Does this happen to you?

I don't understand the humor in having strong passwords. I, as an end user of certain online services can only do so much to protect my accounts, one of which is, have a long and complex password. The service also has the responsibility of storing those passwords in a secure way, however, we all know sometimes this isn't the case.

Sometimes. I also have a family member that keeps all their passwords in a file passwords.doc on the desktop of their laptop. And the password to the laptop is kept in a book with "passwords" on the front, in the computer cabinet beside the desktop PC.

My parents do the same thing, and, as long as the passwords aren't kept on the computer and no one breaks into the house, it's actually not an insecure strategy to keep them in a paper notebook.

Failing that, a "secure keychain" tool is another good way to do it. "PasswordSafe" is very nice if you need to transport keychain-lists among multiple platforms.

I don't think that an "incomprehensible" password is necessarily any more secure than any other. nougat7upstairs is quite a reasonable value as long as you can reasonably control access to the target. And that's where I routinely put OpenVPN, with secure digital certificates, on my front-line. To even reach any service which would allow a password to be entered, you must pass through a cryptographic portcullis that an outsider cannot even detect.

I typically say I don't have to worry anymore about remembering different passwords. And when Yahoo (or something else) gets hacked (again), I only have to change that one instead of all of them and then worrying about making another password I'll remember but will probably forget.
I just have to remember one password.

I have a different pasword for every site I visit and don't store any of them.

https://www.sans.org/reading-room/wh...-tutorial-1636

Easy complex passwords.

This is not really a question of passwords - it's the whole problem of computing security and that the majority of people in general don't care about it, or assume that someone else takes care of it on their behalf.

There's also the culture that if you're someone who concerns themselves with security/privacy, that you're somehow paranoid, etc.

Until that changes, worrying about and issuing directives or advice on password complexity is futile.

Because loss can be insured for, most people are comfortable with substantial risk.