If all these web sites think we should should change our passwords, why aren't they forcing us to? Wouldn't that be safer?