I'm trying to improve my wife's password hygiene, and have now finally got her to use different passwords for different sites. She now has trouble remembering to keep the book of them to hand. She flatly refuses to learn to use another program, like KeePass (Excel, Zoom and a web browser are pretty much her limit).
Even using a password manager, malicious installation of a keylogger would be game over for bank details and the like.
System and use. ADSL router with its standard 'firewall', wifi to several machines including her win10, with the standard Microsoft Security running on it, updates accepted when offered, but no third party antivirus. No illegal or even unusual browsing done on it, it's just used for online shopping, banking, facebook and zoom. It doesn't leave the house, and doesn't get used with random USB sticks. She seems reasonably savvy about phishing, and often asks for my approval before opening emails. I am the only admin user on it.
What exploits could access a simple unencrypted notepad file of passwords on her machine? How much more dangerous is that to have than an encrypted file or a password manager? The only one that springs to mind is having the machine stolen or lost, unless it's possible to remotely access files without actually installing software.