I also use a password manager, and enable two-factor authentication when possible. I mark my personal devices as trusted, so I only have to do two-factor authentication whenever I get a new device.<p>I can think of a few examples of threat vectors where an attacker could get one of my passwords without being able to completely take over any of my devices.<p>1. There might be a browser vulnerability that allows a malicious web page to get one of my passwords - let&#x27;s say it gets to read memory that was deallocated but not zeroed, or it gets to see the contents of my clipboard, or something like that.<p>2. The provider of the service I&#x27;m using might accidentally leak some of their passwords. In the worst case, they might not even notice it.<p>3. In some special circumstances I might have to check my mail on a computer that I don&#x27;t own, and there might be a keylogger.<p>I don&#x27;t necessarily consider these threats to be very likely, but I get new devices so rarely, that even a minor improvement in security makes it is worth the inconvenience for me.