I use 1password and store my keychain in Dropbox. The Dropbox account has a unique email and 50 character alpha/num/symbol password, with 2 factor auth, and login alert emails enabled. Each bank/financial site has its own unique password as long and complex as they will allow. No logging in from memory, have to have my password manager. My 1password Keychain is protected with a complex, long, memorized pass phrase. I use mint to aggregate all my transactions so I can keep an eye on things (with as many accounts as us churners have we need a transaction aggregator or you are asking for trouble). Very few bank websites support true 2 factor (looking at you chase, b of a, citi, Barclay, capital one). Some that do (Edward jones) aren't compatible with mint if you have 2fa enabled, so I don't use it if it doesn't work with mint. Have to balance the risk/reward there.

My primary checking account is at a local credit union who only supports 8 character passwords with no symbols! Drives me crazy! No password expiration either! I don't know how they get away with it. The drugs are too good (very low loan interest and very high checking interest, no fees) for me to give them up. So I just watch that account closely and rely on the fact I've employed the best security I can with them, and NCUA insurance will cover me if something bad happens (wouldn't if I didn't employ their security options to the best of my ability). Not a lot a bad guy could do with that account anyway, short of overpaying my loans for me. No online bill pay or ability to do external transfers.

I keep my social security cards, passports, birth certificates etc in a safe deposit box at a bank with no backups or copies.

With mint, credit karma and credit sesame alerts, and my password strategy, I feel pretty confident that should somebody manage to do something with my identity I would catch it pretty quick. I can't prevent it (if one of the many banks I've supplied my sensitive info to were breached, somebody can get started) but they won't get very far without me noticing.