"You've just been added to John Doe's Reunion.com Address Book!"

"John Doe wants to connect with you! I looked for you on Reunion.com, but you weren't there…"

Any of these messages look familiar? If so, a friend of yours (or at least someone who has your email address in their address book) has fallen prey (knowingly or not) to what many say is an overly aggressive way to coerce people into joining Reunion.com's "get in touch with old friends" service.

In this article you can read a description of how Reunion.com abused the trust of their users and sent out spam e-mails to everyone in their contact list when they gave up their password.

I received an e-mail just like the ones described above that said something like "Someone's looking for you on Reunion.com! Sign in to find out who it is!". Immediately following that was this e-mail:

Consider that this poor guy had personal and business contacts in his address book all of whom got this spam from Reunion. He was more than a little embarrassed.

What To Do

Remember that unlike places like Best Buy and Kmart online, social networking sites make money by collecting and selling people and their data. Reunion isn't the only one training people in bad security by asking for passwords, they ALL do it:

• LinkedIn
• MySpace
• Facebook
• Twitter

They're not providing the service for fun or your benefit, they want as many subscribers as they can so they can serve ads or sell your data to data brokers.

Mint. Give us your bank and credit card passwords!

You would think people would know better than to give up their banking information, but that appears to not be the case. Consider mint.com, a personal finance website where you can supposedly give them "read-only" access to your online banking so they can show you where your money goes and help you better manage it.

This is all good in theory, but they say in their "About Us" page:

Mint.com offers valuable insights and analytic tools to help you better understand your money…but Mint.com is a "read only" service. Meaning: you can view and organize your money with Mint.com, but you cannot move money between—or out of—your bank, credit union or credit card accounts.

YOU can't move money… But can they? And even if they're claiming they can't, did you verify that with your bank first? Unless your bank tells you that they've determined a service such as this is safe, supported, and that they will back up and fraud or accidents, why would you ever take such a risk?

That's not to say that Mint.com is bad (because I don't know that for sure) and, in fact, I think it's a great idea in theory. The problem is that the only thing protecting you once you've given up a password is their "promise" which historically companies aren't very goo about keeping.

Even Mint.com is nothing compared to these guys!

Even if Mint.com employees and everyone else who has access to the data (the network and data administrators) is safe and trustworthy, they still become a target of hackers. The first one to get into their system will have a goldmine of completely defenseless bank accounts to play with.

You might say, "So what's the difference? Banks have accounts too!" True. But banks also have strong regulation, stiff penalties, and financial responsibility for breaches. Does Mint?

What to Do

Remember to distrust new sites and services until and unless you've verified and validated them personally. But most importantly:

The last thing to watch for are the sites that let you log in with multiple different credentials. It's natural to think "oh hey! I can login with a name and password I already have instead of creating a new account on this site… sweet!". What you should be thinking is "this site wants the name and password to my other accounts! Heck no!"

Example of a site with login options

First, the site you're logging into might just be collecting your login information for their own use. Second, if they're legit, there still could be security or implementation issues (like not using https during the transmission from their site to the service that actually owns that login). Third, I'd bet there's at least one if not more ways to trick a site into letting someone into an account when they use this kind of cross-site login.

This is a risky thing to do and should be treated the same as giving away your password for adding contacts.

What to Do

This site wants the name and password to my other accounts? Heck no!

If there's an option to avoid login, do so. In the example I provided, you can leave a comment anonymously or with a simple name/url combo (neither require a password). Otherwise, if you want to use a site or service, just make a new account or use Bug Me Not to see if there's a shared name and password available.

About the only exception is for sites that are owned by others such as the case of Google who owns Youtube and Yahoo who owns Flickr. In those cases, you can go to the main website (Google or Yahoo) and sign in THERE. Then try going back to the supposed "partner site" and see if you're already logged in. If so, they really do have some kind of relationship.

You MAY want to consider the privacy implications of tying all your photos or videos to companies that already know so much about you (Google and Yahoo). For Privacy reasons, it might still be worth creating an entirely separate account on each site.

Sticky Notes

This laptop has a full list of passwords right on it.

Granted using sticky notes is a bad idea, but writing them down isn't necessarily a bad thing. The key is to make sure that the passwords are safe or non-obvious. Keeping them in a notebook in a safe is one idea. Putting them in a file cabinet is another as long as other people don't know that you're doing that.

So this puts you at some risk for the other people in your house/office, that's way better than putting them in an unprotected computer file!

Password Files

Believe it or not, these are worse than sticky notes

A new trend is for people to put all their passwords in a spreadsheet or text file. This is convenient, but a huge risk! There are so many ways that bad guys can get a peek at the files on your computer that if one of those files is a full listing of names and passwords, then the bad guy has hit the jackpot!

I'm not actually against this in practice, but the key is to protect them (similar to having a notebook in a safe). If you make such a file, make sure it's protected by some strong form of encryption. In my case, Trucrypt.

This is also useful in case you need to send that file somewhere over the Internet or put it on a portable device of some kind. If it's encrypted then an online eavesdropper won't be able to access it and if you lose a portable device, the file will be inaccessible.

Password Managers

There are many password management programs out there, but I can't recommend any. That's not to say they're not great because they may be, but I've never had need to use one since I just encrypt the file itself.

Sure those managers might come with extra features like being able to recognize the site you're on and filling your password for you, but those extra features create another risk. Maybe I can trick the manager into thinking I'm on a different site or to put your password into a plain text field where I can capture it. There are lots of possibilities so I just avoid them.

If you do want to look into this, I've heard that KeePass is good (and it does not autofill your passwords which is good).

"Remember Me"

A risk with very little benefit

Granted this will save you about 6 to 8 seconds every time you log in, but consider the risks of using the "remember me" function on a webpage. What this does is place some identifying information on your computer that the site will use instead of a name and password.

So what happens if someone eavesdrops on the transmission of that identifier? Or if that's protected, what if you computer/cellphone is lost or stolen? Beyond that, I already talked about how there are many ways someone can get into your computer. If they browse around and find one of those files and make a copy, they can log in as you without your name and password!

This is a risk that's just not worth the benefit. On some sites you can select to remember the login name without the password which still saves time and is less of a risk, but there's really no justification for remembering the password. It's a risk with no real benefit.

If you're still not sure, just ask Michael who probably used his Mom's computer to check his Facebook when he was home on break from college:

Don't save passwords. Don't let it ''Remember You'' or this could happen to you too!

HTTPS

If you enter your name and password without first making sure you have a secure connection from you to the site you're on, anyone else on your network, in your nearby area (if you using wireless), or on the Internet between you and them can see it!

Read my full HTTPS article here for a full description of what it is, why to use it, and how.

Here's something you might not have ever thought about, but should; if someone knows your username and password, they're very likely to try it at major websites and services to see if it will work there. How to they get your username and password? You give it to them!

A typical online registration asks for a username, e-mail address, and a password; everything a bad guy needs to get into every other account you have if you use the same password for all of them.

Every time you go to a website and it requires signup or registration, you have to give a username an e-mail address and a password. But what do you know about the people who own and operate the site? What if a disgruntled or greedy employee decides to try a little identity-theft on the side?

You handed them your e-mail address so what happens if they were to go to that web service and enter the e-mail address and password you gave them? If you keep good passwords nothing happens, but if you're the one-password-for-everything type, you're toast.

Even if that doesn't work, does that e-mail/username and password combination work at Facebook? eBay? PayPal? They could try hundreds of the best known sites all using a simple web program. The only defense you have is to not use single passwords!

Another major problem is when you are asked to fill in challenge questions. First, if you follow my Geek Privacy Principle, you would never willingly give away information that wasn't necessary. Do you really want to hand over your mother's maiden name to some random website?

Second, if you fill these in, the password reset function may be triggered by the challenge questions instead of your e-mail. That means that if I have or can guess the challenge responses, I may be able to unlock your account without having access to your e-mail account first!

Just ask President Obama who's Twitter account got taken over and used for spam just because he entered real answers to challenge questions (and go figure that someone in the world knew where he lived, what his dog's name is and so-forth)!

The simplest solution for this is to use a privacy alias. By using fake data that you can easily remember, you're not only making the data you provide worthless to the site you've given it to, but a bad guy won't be able to guess.

The only disadvantage is that you're still giving away the data for your one and only privacy profile. A way around this if you use a password file like I do is to make up challenge answers on the spot and just "write them down" in the file. That way you can remember them while eliminating the risk of that information being used against you somewhere else.

Caution: Popular or famous phrases aren't a good option.

While short phrases and exceedingly famous ones are likely in hacker dictionaries, the vast majority in the world won't be. "Four score and 7 years ago" would likely be no good becuase it's so well known, but "The needs of the many7of9" would.

Phrases are great because they're very long, but at the same time very easy to remember. No matter what you pick, be sure to make it abnormal in some way. To simplify this, I recommend you come up with personal password rules that you'll do for all your phrase passwords. For example:

• Always capitalize each word (Capitalize Each Separate Word)
• All numbers spelled out or written using numbers (forty four, 44)
• Use * instead of spaces (this*is*a*sentence)
• Replace the word "the" with "bat" (It was bat worst of times)

It doesn't really matter what you choose, just be consistent. It won't do you any good to remember the phrase, but not the changes that you made to it.

The suffix trick is a method of quickly taking weak passwords and adding length and complexity to them in a simple way. For example, say you have three passwords at three different sites: cat, money and camero.

These are all strikingly weak passwords, but you may have used them for a long time and not want to get rid of them. Fair enough. But take my advice and you can secure them all without changing them too much.

To use the suffix trick, first pick your suffix. Here are some suggestions:

• @site.com – Where "site" is any word you want and ".com" is any domain (like ".gov", ".org", ".co.uk" etc.). Here you are making your password into something that looks like an e-mail address. The beauty of this one is that it adds special characters and good length while being super easy to remember.

  For example, you could use "@hubris.jp" or "@gonzo.uk". Note that using country codes works well because they're more random than ".com".

• 2^3=8 – Math is great because it's all numbers and symbols, but it's easy to remember and understand.

  2+5=7
  9-1=8
  6*10=60
  

  See?

• 3141592 – Pure numbers. This is good for sites that don't let you use special characters in your password. You can go completely random, but in this case, it's pi. Another really great trick here is to use a number that means something to you, but no one else. For example, a friend used his 6-digit employee number from a company he used to work for.
• three3 – Numbers and letters. Again, useful for sites that don't let you use special characters.

• &7sh3 – This is truly random. Pick something as complicated as you can think of (so long as it's only 4 to 6 characters). This is better than some of the other picks because even if a web site admin looks at your password, they probably won't figure out the trick (where some of the other suffixes are pretty obvious).

  Again, good length and now your passwords have numbers AND special characters.

Now that you have a suffix, you're going to go to every website and webservice that you can and add the suffix to your passwords. No matter how long or hard the suffix is, since you're using the same one everywhere, it becomes easy to remember.

For example: cat2^3=8, money2^3=8, and camero2^3=8

Even if someone were to figure out the trick you're using (which is unlikely unless they can already see several of your passwords), they still have to guess the rest of your password (which will be at least as strong as your password was without the suffix).

The suffix trick is the quickest and easiest way to increase your online security right now.

In other words, there's a chance that someone might be able to figure out your trick and your passwords lose the extra security, but in all other cases, your entire online web presence has become more secure with very little effort. This is the least you should do right now until you have time to pick better passwords for your more important accounts.

For a quick and easy proof of this theory, go check your current password at the online Password Meter and then try it again with your chosen suffix.

You don't really have to have a completely unique password for absolutely every online account. The question to ask is, "what level of password is needed?"

Low Level

For example, I have a special account name and password combination I use for any site I don't like, don't trust, don't care about or think I'll never come back to (but that has something I want and requires registration).

For those sites, I use my "throwaway" information which might look like this:

• Username: Hotdog
• Password: relish808

Even if a site requires e-mail address as a login, I still use the throwaway password if I just don't care about them and if that account gets hacked.

Now, if I ever come to a site that requires login and I think I might have been there before, I can try my throwaway information first and see what happens.

Mid-level

For sites that would be inconvenient, but not drastically bad to lose control of, I use what is probably the easiest possible way to make secure passwords that anyone can remember. Here's how it works:

1. Pick rule that you'll use on a website's name. It doesn't matter what it is so long as you are consistent and use it the same from now until you die. For example, let's say I choose 5 characters, proper case (meaning the first letter is uppercase and the rest lower).
2. Next, choose a suffix from above. Math is pretty easy, but anything is fine so long as you pick a good one.

So now you have two pieces. Put them together like this:

Note that because bofa.com (Bank of America) is less than 5 characters, I stop when I run out. Your rule could be to fill the fifth slot with the '&' sign or whatever you want.

Now have good length, upper, lower, numbers and special characters, but the second you see the website, you instantly know the password since the suffix is the same EVERYWHERE and the rest of the password is based on your rule.

High-level

All accounts that protect your money, your reputation, or privacy should use your strongest, most important, most secure password of all. For example, take your most important online account of all… your e-mail. "E-mail? Are you kidding!?", you say? Actually, I'm not.

These forms make every account at risk if someone can get in your e-mail

What you see here is a password reset form. Using it, I can enter your e-mail address and a quick verification number that's shown on the screen and they'll either send the password back to me or reset it to some random value (which they'll send to me). Either way, if I'm in your e-mail, I can unlock your account.

Because of password reset forms, access to your e-mail account is access to your world. Keep your e-mail account secure!

For these websites, I most recommend using the phrase trick or anything that's both long and complicated. If you have to write it down, go ahead, just don't keep the password in an easy-to-access place like your wallet or laptop bag.

If you use these tricks, you'll be more safe and secure than the vast majority of people though you still need to protect your passwords.