I had seen that, NogDog, and took it to heart. I love XKCD. Unfortunately, many sites require you to supply numbers, mixed case, and punctuation -- and the issue of sharing passwords is still a problem. Even if you use Randall Munroe's suggestion, you might still be hard-pressed to remember even just a handful of passwords unless you use each of them frequently.
It seems to me that keeping N separate tiers is a reasonable approach and provides a fundamental advantage in that it firewalls separate accounts from each other to some degree, limiting one's risk. The higher the value of N, the less likely it is that one account getting compromised will lead to another account also being compromised. Perhaps someone could take a guess at expressing our risk as a function of N?
Derokorian's approach of adding additional words depending on context seems to add a little security with relatively little memorization cost, but I wonder how much security? I expect the additional security is significant as long as the plaintext passwords are never stored, emailed, or revealed. As soon as a human being has seen two variations of a given password, a pattern might be detectable.
Aside from the passwords themselves, many accounts are linked or offer password reset options. E.g., you can reset your bank password by having an email sent to your email acccount. And that email account might have a backup email address in case you needed a password reminder/reset for it as well. The whole advantage of having separate passwords for separate accounts would be nullified unless you took care to segregate your accounts into non-connected groups.
I wonder if someone has concocted some kind of equation to evaluate security risk for accounts. Maybe something like the Drake Equation ?
