3 is stupid.

The point of a password manager is to enable the use of multiple different passwords and usernames. The point of using multiple, hopefully unique, passwords and usernames is that when joes website gets breached and their passwords and usernames get leaked because they were storing them in plaintext it doesn’t mean all your accounts everywhere else are now compromised.

That happens a lot and if you want to learn how affected you are at this very moment just check haveibeenpwned to see what’s osint on your usernames.

So let’s say you’re appending the classic “monkey1” to your autofilled password manager passwords. You’d be protected from a password manager breach until one of your website logins is breached and someone realizes all your gibberish high entropy passwords have “monkey1” on the end. Considering there are billions of leaked credentials and millions get added each week, that’s kind of like putting wallpaper up so the tank coming through your brick wall has to work a little harder.

So what would be actual good advice? Key rotation. At some interval, clear your cache, browsing history etc and change all your passwords. Now you’re actually protected from breaches of old credentials and current credential breaches are rendered moot.

If you read all the way down to here, consider not relying on this community for privacy or security advice. The fact that “stupid asshole” was able to easily articulate why something on the list is a waste of time when no one else has done so should raise some eyebrows.