[telecom] Why passwords have never been weaker-and crackers have never been stronger

AFAIK, the most serious threat to passwords is that they can be monitored when their owners enter them via open Wi-Fi hotspots. In that case, no cryptography is required: unless the owner has his email set up for encrypted connections (the default settings don't do that), his password is transmitted en clair.

Of course, once the password is compromised, it (or trivial variations of it) can be used to gain access to other sites and/or email accounts, *EVEN* *IF* those sites use encryption. /That/ is probably the most dangerous scenario: if a user has the same or very similar passwords for "POP"-based email reception or to send outgoing emails, or at a gaming site or online forum that doesn't use SSL encryption, then the attacker can access web-based email sites with it.

In other words, if your Gmail password is the same one you use when sending or receiving emails in Outlook, Thunderbird, Eudora, etc., then a nearby sniffer can get it without any decryption effort or delay. One common attack that is currently in use is to obtian the password of a user, use it to access Gmail or Yahoo mail, lock out that same user by changing it, and then use the user's online address book to send his/her friends and family a sad-luck tale that creates a lot of Western Union transfers very quickly, typically by claiming that the owner was in a foreign country on short notice and has been mugged.

I'm like most travellers in one way: if I'm in a place with open Wi-Fi, I'll take advantage of it to check my mail while waiting for my flight. However, unlike most travellers, I have my email connections set to connect using SSL, and thereby deny nearby sniffers any chance to copy my email addresses or passwords.

Bill

Per Doug McIntyre:

I don't have the brainpower to cope with a separate PW for each site, but I do have several levels of password:

- "Who Cares"... for sites where the consequences of compromise are insignificant.

- Convenience: Where compromise would mess a few things up but not rock my world.

- Fort Knox: I use this on my ID/PW DB, admin access to my PC's, and a few other things.

FWIW, I wouldn't do online banking or trading even on a bet.