Another thing he might consider is setting multiple rounds on the SHA512-crypt hash used by default in Ubuntu. Something like 'rounds=512000' would be sufficien

Another thing he might consider is setting multiple rounds on the SHA512-crypt hash used by default in Ubuntu. Something like 'rounds=512000' would be sufficiently strong for now. That would cause a perceivable delay during logon. Probably about 4 to 5 seconds, but on a single-user laptop that would be just a slight inconvenience. Also he should use an extremely strong/long password that passwdqc approves of. Doing this would protect against the scenario where he happens to leave a root terminal open and the maid copies his /etc/shadow to a usb drive and gives it to some government agent to crack... well good luck to them.