I'm developing a site for the first time, and I'm trying to work out the best way to store and track all the accounts/passwords e.g. Server passwords, ftp passwords, API passwords (FB, Google, Twitter), Email account passwords. There's a lot! If any one of these is compromised it could do a lot of damage.
Also, I use public key authentication over SSH for connecting to my server using putty, but sadly, i actually fail to understand how this is safer than using default root login with a good password. For the private key is stored on my local machine and a password is not (hopefully not written down in plain text elsewhere).
So what if my key was stolen? Would the thief be able to use that key to log in to the server and wreak havoc?