First, be careful of your security in what links you click on & have (windows) anti-virus & other software security. Also, simply select "no credit card" in your iTunes account, & just buy iTunes cards to redeem when you want to make purchases. I never keep a balance of over $10-20 in my account at any one time. That way, if my account is compromised, the crooks don't make any significant money. If you otherwise suffer a $1000 loss, you may eventually be able to successfully argue with your credit card company & have the charges reversed, but then the card company has to eat the loss. Either way, by selecting the credit card option in your iTunes account,YOU ALONE CHOOSE to provide the opportunity for these thieving bastards to profit & not have to otherwise honestly work for their money. They can only hack your account by tricking YOU into clicking on a bad link or compromising YOUR computer. Don't feed them.

8 characters with mixed capitalization is worthless. They should require 10 character with 4 character types. Numbers, Symbols, Lower & uppercase letters.

Also wouldn't hurt for device activation to also require inputting characters from a garbled image to insure you're a real person & not an automated account hacking program.

deleted

...Which is all really great when entering data from an iOS device far too frequently. There has to be a balance between security and usability. Sadly, my iTunes password is my least secure of any accounts due to the limitations of having a memorable, secure password.

I recently was trying to make a charitable donation, and the capatcha kept me from being able to do it. After four tries, I decided another charity might be more worthwhile...

The gift card approach is a bit tin-foil-hat, and just limits your risk. It doesn't fix the fact that the system requires you to take on undue risk in the first place.

To my other note, a lot of people don't understand what makes a strong password & there are some pretty weak ones out there. Never use common words, try to use 10 characters or more, mix 4 types of characters. Just couple examples (please don't use these).

Applerocks (Not strong, only a matter of time before you are hacked)
Apples01 (Ok but not strong)
Apples0001 (Much better but good programmer could create cracker that guesses common words)
@pples0001 (Even better, no common word)
@ppleS0001 (Very strong, uses upper & lowercase, symbol, & numbers)

Always have a separate password for things like e-mail & web forums than what you use for financial stuff. If you have mobileme I strongly recommend creating an outside e-mail account like gmail that you give to signup pages or friends who you know who's accounts get hacked frequently. You should also create e-mail aliases in mobileme that you can send from so if an alias gets compromised you can just delete it & create a different one. You can't protect against everything 100% but these steps can go a long way. Then of course I second everything kellya74u is saying, especially clicking links in e-mail. Make sure you check automated looking e-mails, check that the name tagged to the sender actually matches the e-mail. Recently got an e-mail from a friend (had their name on it) but the sender address was notify@domain.com. It had a link with instructions to sign into a site, it was a spam company that then would steal your gmail credentials by tricking you into typing them in & then it would get all your contacts from your account. Don't get click happy!!! Use your brain & practice some skepticism! Never think of the web as a safe place, it's actually extremely hostile (even inside services like facebook).

You can build complex passwords that are easy to remember, see my post on passwords.

If you think it's annoying to have to remember a more complex password or use captcha, try cleaning up your name after being a victim of identity theft. I guarantee that it will change your view on the inconvenience of security.

reported so many times, it can't be news. Apple / the US government and China overlook this (among other things) to keep harmonious relations. Apple wants to sell its hardware, and is following, to some degree, Microsoft's China strategy which, in the early and late 90s, was to allow China to pirate its software to enable future sales. More 'free' Apple services, sells more Apple devices... Think about it... lots of similarities.

Article doesn't mention that you can buy other country iTunes accounts for 1RMB (12 cents).

Only thing surprising this week was alibaba (which owns taobao) removing 'iPad2 cases.' One can only Wonder why Apple pulled out its muscle for this and not the fake iTunes accounts that are openly sold

Yes but how many of these accounts were phished? You can have the best password in the world but if you fall victim to a phishing scam your hosed.

Doesn't negate my point, actually I mentioned that too. Like I said before, the internet is not a safe place, it is actually a very hostile environment & no one should use it lightly.

I advise everyone who has an iTunes account to only use itunes gift cards, and never put your credit card info on your iTunes account.
If you must us iTunes, go out and purchase the $10 gift cards and only activate them when you need to purchase something.
My account was hacked to the tune of $63.
No notification was sent to my email address (which was registered with my itunes account).
The crook was able to change my login, password, email address, and purchase apps outside the US.
The Apple terms expressly forbid US accounts purchases outside the US. (or they did at that time.).
So iTunes security is non-existant. It's a joke. Worst security on the planet.