The ultimate solution is here:
http://zzamboni.org/blog/ellen-on-password-security/