using the same password for everything. If any one of those sites encounters a breach and your password is published, then you've really given access to multiple sites, often including sensitive data. Should that exposed password be tied to your school accounts, you could be exposing sensitive data about staff and students.