No mention of implementing two-factor authentication where possible, as available with gmail, yahoo mail, dropbox, Bank of America, among others?

I always cringe when I see this advice on passwords, when every academic paper I have seen in the past ~ 12 years says that password aging is considered harmful:

http://www.cryptosmith.com/node/218

https://www.schneier.com/blog/archives/2010/11/changing_passwo.html

https://lopsa.org/content/password-expiration-revisited

http://www.cerias.purdue.edu/site/blog/post/password-change-myths/

"Policies requiring regular password changes (e.g., monthly) are an example of exactly this form of infosec folk wisdom."
- Gene Spafford