I got this message as well and it finally got me into overhauling my personal password security. I had been intending to do this for over a year now, but never got into it until now. See, I've been a bit lazy and used a collection of several passwords across low-security websites such as discussion forums. In places where compromised password would actually be a concern such as my server logins, Google or Facebook accounts I use unique passwords.
So what exactly I mean by overhauling my password security?
Step 1: Register to Dropbox and set it up.
https://www.dropbox.comStep 2: Install KeePass 2.
http://keepass.infoStep 3: Create new database in KeePass 2 using both keyfile and master password, then export it to your Dropbox folder. Just avoid the Public and Photos folders.
Step 4: Review KeepPass settings as it offers quite a few security settings you can customize to your liking.
Step 5: Start changing all your passwords you have by creating a new entry per account in KeePass.
* While default 20 characters long random password suggestion offered by KeePass 2 is really secure, it's a ***** to type when copy&paste is not available. So I adopted a custom pattern of aaa\-aaa\-aaa\-aaa instead. It's like a cd-key. This is much more convenient when you need to use your phone to see your password and type it on a PC. 12 random lowercase alphanumeric characters separated by dash is a good compromise between security and convenience. There were about several places though that didn't accept either dashes or had limitations to password length.
* I could only remember so many places I might have an account at, so I combed through my email using keywords such as "account", "password", "register", "registration" and "happy birthday". 50 entries and half-a-day later I'm finally done. There can't be very many places left I haven't changed my password at if any.
Step 6: Use mobile phone authenticator where possible. See these for example:
*
http://googleblog.blogspot.com/2011/02/advanced-sign-in-security-for-your.html*
http://us.blizzard.com/support/article.xml?locale=en_US&articleId=24660Step 7: You can either install Dropbox and KeePass on other computers you personally use, or get one of those very small USB drives of thumbnail size. If you have supported phone, such as android phone you can also install Dropbox and KeePass on your phone. Since your encrypted KeePass database requires both master password and keyfile to be readable, losing your USB drive or phone is not catastrophic.
Is this worth spending half-a-day in front of your computer changing all your online passwords? Considering how many security breaches there have been in the last three months and it is quite likely you've been affected by at least one of these security breaches, I'd say yes. Especially if you so happen to share one or more passwords between multiple accounts. Same applies to Dropbox, even if someone gains access there, the password database is unusable without master password and keyfile.
At least after all this trouble I went through today with these steps, I know a security breach in one place won't compromise other accounts anymore. Even if I shared passwords only at places where compromised password wouldn't do much harm anyway, it's more like matter of principle.
