Most people have only second hand exaggerated experience with credit card theft. And they don't hear our stories where a few hundred was charged and the stores refunded or the banks got the money back right away. Instead they hear my buddy's story where their debit account was cleared out and it took 45 days to get the money back. So people panic.
Same thing with the personal information. It doesn't matter that this information (and much more personal stuff usually) is already out on the net and easily accessible for most. Because it was "stolen" makes it ten times worse in their eyes.
But as many of us have been saying from the start, two months after services are fully restored I would bet that many/most who said they will never buy again, or will even only use points cards will be back to having a card stored on their and buying. and why shouldn't they? While breakins happen on the net every single day, breakins to a single company are often only once... heh... followed up by a massive investment in improved security infrastructure.
I've tried this a few times.. pointless really. at this point I use either two or three words that make sense to me usually separated by numbers and/or symbols. of course this is only for the stuff I REALLY care about (i.e. home computer, work security logins, etc). For most sites (and even commerce sites) I'll just do something like "bhjcfil90wef89023hur23" and then let firefox remember it. if my saved passwords ever die then I just say "forgot password" and do the same thing again.
