I happen to use the open source password manager from Keepass.info. It works on a local password file protected by strong crypto. Then, I use Dropbox to sync that file from device to device.

The problem with using the same password on multiple sites is this: if any one site gets pwnd, it gets a lot easier for the cybercreeps to pwn your account on other sites (says Obvious Man).

It doesn't take much technical skill to credential-stuff--to hammer a lot of sites with a list of credentials. So, keeping the list of sites you actually use a secret is not effective.

This whole deal sucks. But it's real.