I hadn’t joined the discourse by this stage, so I’ll just add it here – re choosing a password…

The best advice I’ve heard was this:

Pick a reasonably secure “base” password, and then customise that password for each place you use it.

So if the base password was “p4ssword” then when you used it on Google you might choose the first two letters of the domain (“go”) and add them to the end of the base password – so it becomes “p4sswordgo”

In practice you’d chose a better base password, probably not put the letters at the end, and maybe choose the 1st and 4th letters of the domain or something…

So base password “fA$wX3upX1″ becomes “fA$wg3upg1″ when you add the 1st and 4th letters of Google domain in place of the X’s.

This makes it possible to use a (practically) unique password everywhere, but only have to remember a single password. Even if some captures your password from one site they will not be able to use it elsewhere.

Obviously given two or three examples of the password it would be possible to deduce the pattern, but that would require a human analysis and the risk if very low there unless you’re being specifically targeted.

You could also have a couple of different bases, which makes whole concept even more secure.