Great post, Since most webservices still store your password on their server. It is wise to change passwords every 3 months and never ever use the same password or phrase twice. You mentioned that. Other risk of fake websites you mentioned. Harder is to prevent a men in the middle attack in a cafe. Some black hats could spend a couple days in a bizzy cafe or above it for example stealing credentials with an ARP-spoofing attack which they sell in a big list of the darkweb after a few targets in a month time. I did a post on passwords a while back with the pwgen method. Good to see people keeping up the awareness.