This is good advice, but I would ad Request Policy (if using Firefox) or Ghostery (if using Chrome; I would also suggest using Chromium instead of Chrome). I believe NoScript is also a must, but it does take some work to whitelist the sites you trust.

It took me a half hour to explain how to use NoScript to a non-technical person the other day. This stuff is not intuitive, and it will take time to educate our friends and family. Now that Facebook has made it acceptable for normal folks to be social on the web, we must be persistent in teaching these people to protect themselves.