@nealmcb asked me (Thanks!) about this and this is indeed a great question that is not covered in our paper. I agree that we are not giving enough advice about how to deal with DPAPI security. I will fix this by writing a blog post but in the meantime here is an overview of what you can do:
Overall DPAPI is a blackbox API that allows you to tie any secret data, such as the firefox passwords database, to a windows account password. To decrypt any DPAPI secret you need a hash of the user password (in SHA1 (16_LE) not NTLM though).
So in an offline attack setting an attacker first needs to brute force (or guess) the user password to get this hash, so a "strong" password is definitely the first good line of defense. But remember that we have rainbow tables for NTLM so DPAPI security is also affected by this.
Disk encryption such as bitlocker and truecrypt are a good first line of defense against this because the attacker obviously needs to decrypt the hard drive before attempting to recover the DPAPI data.
What is not a good idea is believing that EFS will solve the problem, because the certificates needed to decrypt the file are encrypted with a "DPAPI" like system. So once the user password is known, all the attacker has to do is first decrypt the EFS files by recovering the certificate and then decrypt the DPAPI data.
I hope this clarifies the situation. For the CREDHIST problem, I am thinking of writing a tool that clears it (at least the first N old passwords).
Let me know if you have other questions