Number 8 is overrated, it requires physical access to the password and is less viable than any pure online attack. See http://www.schneier.com/blog/archives/2005/06/write_down_you...