Can I use the same password for my Computer, Mobile and Password Manager?

Question

I am considering using the same password for my Computer, Mobile and Password Manager.

The premise of the "password reusing is bad" rule is that if one website leak the password then all of your accounts on other websites are vulnerable.

But I don't see how it apply in that case. If somebody got access to any of my devices then it's almost game over for me because I am already logged in the critical services on my devices (gmail, bank, etc...).

The mitigation for that kind of situation is within each service by requesting 2FA for critical activities (send money, delete accounts etc..)

Using the same password would allow me to memorize one 15-20 random ASCII password , which I think would be way more secure than three different 8 ASCII password for example. Moreover, one single password allow me to change it more often.

Is this a good idea? What are the issues and threat of this approach? What would you do?

Answer 1

Consider that the password of your vault (password manager) is not stored anywhere (only in your head) if you are using a strong zero knowledge vault.

If you are using it also as the session password of your Windows computer and your mobile phone, then it is stored in their memory as a hash.

The difference is not huge because, for both, an offline bruteforce attack is the main threat against your password. Indeed, most of the time your vault define a random crypto key, use it to cipher your passwords and protect this key using your password. So the attacker needs to try many passwords to invert the key protection and check if the result key correctly decipher the passwords database.
It is a bit harder than just trying to reverse the hash of a Windows computer.

In order to not increase the risk by reusing the password for your computer and your mobile, I would advise you to enable the encryption of your PC and your mobile.
This way, an attacker cannot access to the active sessions where you are logged (GMail, bank and so one) by directly reading the disk.

But remember that there are more chances that an attacker get a physical access to your mobile or PC (if you lost it, if it is stolen, ...) than to your vault (he should find a vulnerability to dump the database)