To protect against password compromise in general, use 2 factor auth. For this to really work, you need a way to detect compromise of the password. This way th

To protect against password compromise in general, use 2 factor auth. For this to really work, you need a way to detect compromise of the password. This way the 2nd factor holds you over until you've managed to rotate all important enough passwords. Alternatively, separate trusted hardware with an interactive (i.e. challenge-response) protocol. Something like a TPM or yubikey.