In reply to Keith.

Great comments Keith and thanks for reading the blog article. Good point about 2-factor authentication - that is an extremely valid recommendation and one which I simply inadvertently left out - sorry! As for password changing, while I do see the potential disadvantage when users select trivial passwords - since they have to frequently change and remember them! - I think it is shortsighted, especially for those of us providing security advice, to advise folks to keep their passwords static for too long.