lindsayB3462 wrote:Any suggestions regarding preventing the password stealing?
You can't do anything about passwords being stolen. That's up to the web site operators. And 100% security is impossible.
Provided that the web site has encrypted the passwords, you can make your password harder to decrypt. In recent years the hackers have developed some incredibly powerful tools such as rainbow tables and gigantic lists of actual passwords that have been used in the past, and any advice on password-picking that's more than a few years old is probably out-of-date. Here's an article that's kind-of techy, but makes the point that it's gotten darned hard to pick a password that isn't easily decrypted:
http://arstechnica.com/security/2012/08 ... r-assault/ [Hint: length still matters. The longer the password, the harder to crack, unless it appears on a list of previously-known passwords.]
What you really
must do is to stop using the same password for multiple sites. The big problem with the LinkedIn break-in wasn't that shady people could now log into your LinkedIn account, but that you probably used the same password on a bunch of different accounts, and now they have your email address(es) and the password. A simple script will try hundreds of popular sites — including most of the webmail sites — to see which ones it can log into. If they can get into your email account, they can start requesting "forgot my password" actions from other sites that you used a different password on. How bad can the result be?
Wired magazine's Mat Honan recently found out:
http://www.wired.com/gadgetlab/2012/08/ ... n-hacking/
For me, the LinkedIn hack was the wake-up call. Like most people, I'd been using about a half-dozen different passwords across about 150 different sites. I got a password management program — me, I went with OnePass — and started changing passwords everywhere. Every one of the web sites I access now has a different password, and OnePass takes care of supplying the correct password. It also generates random passwords for me whenever I sign up at a new site or change the password on an existing one.
Now, if hackers break into a site and get my password, at most they'll have my password to that one site. And if that site properly encrypted my password, the hackers probably won't even be able to get even
that much.
