The point of services like last pass is that a website with shitty security won't compromise all your accounts on websites with decent security.
The point is you only trust one security specialist company rather than many non security specialist companies.
It's getting to the point where if you don't use something like lastpass, then reusing passwords to some extent is needed - or do you remember 20 different passwords for each site you visit, even when you visit them only once a year?
You're right that the password-vault part is the weakest part of the post, I think, though I'd argue many people probably don't even use (relatively) secure options like LastPass, and probably default to "password managers" built in to browsers or OSes.
I just have this weird cognitive dissonance when I see the 'big threats' that get posted sometimes online. The other day I read a Reddit post about some Dangerous New Threat to Bitcoiners, that amounted to nothing a slightly-more-clever-than-average attachment virus. I don't understand how anyone managed to get as far as even operating a Bitcoin wallet and somehow never learned basics like "don't click blindly on email attachments".
> I don't understand how anyone managed to get as far as even operating a Bitcoin wallet and somehow never learned basics like "don't click blindly on email attachments".
Perhaps you're not the best person to be giving security advice if you don't understand why people - even those who should know better - click on email attachments?
The point is you only trust one security specialist company rather than many non security specialist companies.
It's getting to the point where if you don't use something like lastpass, then reusing passwords to some extent is needed - or do you remember 20 different passwords for each site you visit, even when you visit them only once a year?