I'm a firm proponent of using a password manager like Keepass to generate and store secure passwords. I also encourage others to do the same.

But there's always one person who says they'll never use it because it keeps all their passwords in one place, so if an attacker breaks into their Keepass database, they will then have all their passwords.

I've been pointing out that the same thing can happen with their email accounts, and that the attacker can just use the "forgot your password?" option to get all their passwords, but it usually doesn't help, and I'm a bit curious about this myself.

Does anyone have any more in-depth rebuttals to this?