One thing that I'm moving more and more doing is using separate random aliases for just about everything.
The idea is that if someone tries to get information on me to figure out a password or answers to security questions, the name they look for information on has nothing to do with me.
As it is, when answering security questions any more, my answers are NEVER answers to the actual questions. For example:
What is the name of your favorite teacher? The New York City Space Needle
What is your favorite hobby? Eating really big trees
What is your mother's maiden name? The fifth of November
My favorite is when you can create your own question:
What is the answer to the next question? The answer to every question is three.
Of course, you have to write it down.
Also, I don't reuse passwords on the Internet. I do have a few hundred devices protected from the Internet with the same password -- I tried using different passwords for each, but that created all kinds of problems as I lost track of which password went for which device.
In general, my passwords are non-sensical passphrases whenever possible. For example:
Beat the hell out of the zenzizenzizenzic
Land of the Hollow Chocolate Walrii
(As if Walrii plural for Walrus?)
Sometimes I use something that looks like an ingredient in a recipe
75 # Rancid Oysters
The thing to keep in mind that in general, the longer the password, the better. A 30 character nonsense passphrase.
For e-mail, I try not to give two web sites the same e-mail. Using a '+' alias, I generally create the e-mail address for a site by appending a '+'', the time in 24 hour format, and an abbreviation for whoever I am creating the e-mail for. For example, eric76+0329ta@example.com. This doesn't always work because some idiots refuse to accept a '+' as a valid character in an e-mail address.
For banks and credit card companies, I have a separate e-mail address that is just for them. Nobody but them ever sees the e-mail address. The idea is to have an unusual e-mail address that is nearly unguessable so that if I receive an e-mail from the bank or credit card company to my normal e-mail address, I have an immediate strong suspicion that the e-mail is bogus.
For example, 3.14159265358979323846264338372@example.com. Think having pi is too obvious? That's not pi. Pi to that many digits differs a bit. Remember that the maximum length of the username of an e-mail is generally 64 characters.
And the total length of the entire e-mail address is 255 or 256 characters. Thus, 3.14159265358979323846264338372+american_express_centurian_bank+3.14159265358979323846264338327@example.com is a perfectly valid e-mail address. Note, however that American Express doesn't seem to like a '+' sign in an e-mail address.
So, to sum it up, when possible:
1) stay anonymous whenever possible
2) never use a real answer for a security question
3) use nonsensical passphrases, preferably with at least one obscure word or play on words
4) use '+' aliases in your e-mail
5) create special e-mail addresses for banks, credit cards, and other sensitive sites
As for the actual question asked regarding web browsing, it doesn't hurt to reinstall the operating system from scratch on a regular basis. Back up your data frequently. On my main workstation, I can wipe the hard drive, install a new operating system, restore my most important data from backups (about 60 gigabytes), and be back up an running in an hour or so.
If you want to go up from there, use virtual machines. Create a virtual machine for the web browsing that is refreshed from scratch every time you open it. The idea is that should an attacker manage to write something malicious to the virtual drive for that OS, when you log off (do it frequently), you come back to a clear, untouched virtual machine when you need the browser again. If you really want to get serious about this, use the Qubes OS:
https://www.qubes-os.org 