Password reminder

I moderate a local list serve and increasingly must deal with folks whose aol, hotmail, yahoo, and other mail accounts have been hijacked so spammers bombard their address books with spam emails.  Fresh from a quite detailed ArsTechnica post by Dan Goodin last week about the current state of website and password security, http://arstechnica.com/security/2012/08/passwords-under-assault/, wanted to bring out some of the more potent points from the piece for the many folks who would benefit from practical and less technical advice.

• Password cracking has advanced to the point that choosing a dictionary word for a password or using a password of less than 9 characters is not a secure practice. 
• Because of the number of passwords that have already been added to hacker databases, the common passwords using a word with numbers after it (e.g. strawman456) are also not secure.  
• Avoid using your email address as a user name if possible.  
• We have no control over whether a website we log into, from banking, to travel, to webmail, to business websites to leisure websites, will have a data breach or hack.  Much of Goodin's article deals with website security practices (encryption methods) that are beyond the role of most users.
• But if you use the same user name and password on multiple sites, when any one of them is breached, the bad actors will always try to use these user names and passwords on more important sites.  
• For example, reported breaches sometimes do not involve the actual site being breached, but instead that user passwords stolen from other sites were used to log in.  Dropbox has claimed this recently, Dropbox example, and Pi security expert Lawrence Charters has argued that the recent press about iTunes breaches involved not penetration of Apple networks, but instead use of users passwords scoured from other sites.
• OTOH, says one of Goodin's sources, tech security advisor Per Thorsheim, "If your password at that site is unique, you have much less to worry about."
• Use of a Password Manager program is highly recommended.  Goodin points to 1Password or PasswordSafe, and another used by some of my user group members is LastPass.  I use 1Password and one helpful feature is that I can list all logins by strength of password - this gives me the list of places for my to do of updating the password.