It seems yahoo was compromised in 2014 and only just figured it out, that's the worst kind.
Anyhow, today just changing passwords isn't enough. Most reputable services now support 2 factor authentication and even there there are risks - e.g. RSS security's widely used SecureID has been compromised more than once due to flaws. Security experts generally agree that proprietary solutions like RSA uses are prone to more attacks than systems that can be externally validated.
The two 2fa systems that I have the most faith in are Duo security from
duo.com and yubikey which is a hardware solution which authenticates through your USB port.
I use both, both for my Google account and for my work account (where I don't have a choice). The larger banks are also incorporating 2fa in their online offerings.
2fa means the attacker needs to both compromise your password and your device (key or cellphone).
As a way to manage good password practices I'd suggest LastPass. Again, their algorithms have been externally verified. Their app and browser plugin let you store safe passwords locally.