I should? We're not talking about me, we're talking about your advice! Let's say someone's e-mail is in their profile, and let's say it was listed in one of th

I should? We're not talking about me, we're talking about your advice! Let's say someone's e-mail is in their profile, and let's say it was listed in one of the compromised datadumps, or I was lazy and entered it in https://shouldichangemypassword.com/ https://shouldichangemypassword.com/ and it found an entry or two. Without much work I find a couple of compromised passwords and now I have access to all of the other accounts. I suggest instead: Step 1: random passwords saved in a password safe. Step 2: add 2-factor authentication Along with security updates auto-installed, virus scanner, no untrusted programs, firewall, etc. etc. I don't think your suggestion of common passwords with a prefix is good advice.