Although it's primarily a layer of obfuscation ("security through obscurity is no security at all", etc.), http://blog.woobling.org/2009/05/your-openid-sucks.html tells you how to simply set up your own OpenID delegation through a URL of your choice. While this will not prevent someone who cracks your actual OpenID provider from making use of your credentials, it still does provide two actual benefits in that case:
1) It conceals your actual OpenID provider's identity, making it less obvious to an attacker whether you're using the compromised service or not. While this concealment is easily penetrated, it's an extra step that they'd have to go through to determine whether your account is affected, which will keep you safe from attackers making use of bulk exploits. (If everybody else's door is unlocked, even a trivial lock will keep thieves at bay.) You'd then only need to worry about attackers who are specifically targeting you.
2) If your OpenID provider is cracked, you can trivially switch your delegation at any time to a different provider who, hopefully, has not been compromised. This still leaves you vulnerable until you learn of the incident and change to the new provider, but, once you change it over, your OpenID-based accounts will once again be secure without needing to visit all of the sites you use OpenID with.
...I would protect myself by changing my passwords ... where I use the same or a related password.
- why wait until the horse has bolted? Don't use the same password in more than one place; use some hashing mechanism (or browser plugin, etc) to get unique pw's per site, or at the very least just add the first few letters of each site's domain (or some other modification that you'll remember!) to the end of your "normal" password to make it a little more unique on each site.index.html
.