The best information on surges and surge protection I have seen is at:
http://www.lightningsafety.com/nlsi_lhm/IEEE_Guide.pdf
- "How to protect your house and its contents from lightning: IEEE guide for surge protection of equipment connected to AC power and communication circuits" .
And also:
http://www.nist.gov/public_affairs/practiceguides/surgesfnl.pdf
- "NIST recommended practice guide: Surges Happen!: how to protect the appliances in your home"
The IEEE guide is aimed at people with some technical background.
The NIST surge guide suggests most damage is from high voltage between power and phone/cable wires (for instance at TV/related equipment).
When using a plug-in protector (or UPS) all interconnected equipment needs to be connected to the same plug-in protector. External connections, like phone and cable, also need to go through the protector. Connecting all wiring through the protector prevents damaging voltages between power and signal wires.
my understanding is that ungrounded surge suppressors are nonfunctional
Without a ground plug-in protectors still provide surge protection. As explained in the IEEE surge guide (starting page 30), they work primarily by limiting the voltage between all wires (signal and power) and the ground at the protector. That happens even if the "ground" is not connected. They do not primarily work by earthing the surge through the ground wire. However using them without a ground is not a good idea. And particularly not if the phone wires go through the protector.
Two prong or three? Code is blunt clear about this. If two wire (ie early 1960s or older), then only two wire receptacles or a GFCI is permitted. If three prong receptacles are installed, then you have created a serious human safety issue.
It is possible that the wiring system has a ground (like BX) but has only 2 prong receptacles installed. With only one circuit it is not likely (wiring is probably pretty old).
All appliances contain major protection.
A lot of equipment has no surge protection. Not likely much has "major protection".
One 'whole house' protector connected short (ie 'less than 10 feet') to earth ground.
Service panel protectors are a good idea.
But from the NIST guide:
"Q - Will a surge protector installed at the service entrance be sufficient for the whole house?
A - There are two answers to than question: Yes for one-link appliances [electronic equipment], No for two-link appliances [equipment connected to power AND phone or cable or....]. Since most homes today have some kind of two-link appliances, the prudent answer to the question would be NO - but that does not mean that a surge protector installed at the service entrance is useless."
A service panel protector, by itself, does not limit voltage between power and signal wires.
Does not claim to do what many have posted here. If the UPS did that magic, then spec numbers were posted that define each UPS solution. No numbers will be provided.
Westom always ignores specs that are provided anyway.
Both the IEEE and NIST surge guides say plug-in protectors are effective. So are UPSs that have the same protection added. They are not a great idea with no power wiring ground.
A service panel protector is likely not practical with a slum landlord.
As Mark said, isolation transformers (unless ferroresonant) do not provide surge protection. They are likely rather expensive.
Everyone agrees that GFCIs provide protection from shock. One problem is that they are significantly larger than regular receptacles - they are sometimes hard to get into the box. One possible way to use GFCIs is to put one in a weatherproof box (has no holes) with a cord to a 2-prong plug. That means no electrical work on the building and the GFCIs can leave with the OP if he moves.
There is less equipment that has 3-prong plugs these days. The OP may not need GFCI protection at many locations.