I really should have knocked on wood when I wrote about passwords last week. I was practicing what I preached and knew that I was safe. But sure enough, my old Yahoo email account was just hijacked.

I stopped using this account after I signed up for Gmail, and it had some really old contacts in it. At one point a while back, and after not logging in for over a year, Yahoo sent me an email saying that the account was going to be deactivated. So I logged back in, deleted old messages, contacts, etc, and moved on.

But apparently, those old contacts were not actually deleted. They must have remained somehow linked to the old account, and available to anyone that would be able to hijack it. When whoever or whatever hijacked the account, they were able to send an email to all the contacts linked to the account and make it appear that it was sent by me. The email contained a hyperlink to a program that could be harmful to your PC.

I’m still trying to contact the folks that may have received the malicious email and make sure they are OK, and so far it doesn’t look like anyone was hurt.

Here is a summary of what this episode teaches us. I think it applies to everyone.

• Just as in the real world, you are never 100% safe. You always need to be on guard.
• Old accounts that you no longer use may still contain data that could be useful to hackers.
• Make sure that the passwords you choose for ALL online email accounts are the strongest possible. They should contain at least 8 characters, have no dictionary words or other recognizable patterns and be a mix of alpha, numeric and symbol characters.
• Make sure your anti-virus and anti-spyware programs are working and contain the most recent updates.

For more information on good password selection, Thoughtpick.com has a very good article on creating strong passwords.

Your online security is only as good as your password. You probably make regular visits to dozens of sites that require passwords, so keeping track of them can be a chore. Dealing with so many passwords causes people to do some very unwise things. They might write them down, or store them on a computer file, or even use the same password for everything. All of these defeat the purpose of passwords and can result in compromising your important data.

Recently, an anonymous user posted 10,000 usernames and passwords that had been lifted from Windows Live Hotmail accounts. An online internet security company analyzed these passwords and found some very distressing trends.

• The most common password was ’123456′
• The second most common password was ’123456789′
• Many passwords were people’s names
• Only 6% used strong passwords which contain a combination of alpha, numeric and other characters

With the requirement for so many passwords, how do you keep track of them?

Security experts say that passwords should use a combination of letters, numbers and other characters and shouldn’t include names, dates or dictionary words. They also say that you should change your password frequently. It’s no wonder that people feel they have to write them down.

Here are some simple rules and tips to help you with coming up with secure passwords and then remembering them when you do:

• Make Passwords Hard to Guess but Easy to Remember
  When establishing passwords, think of a short phrase that only you would remember and make an acronym. For example, “I Love The Rain” would yield ‘iltr’.  Now, capitalize one or more of the characters and you have ‘iLtr’.  Using this method, you will come up with virtually unguessable passwords.
• Develop Several ‘Core’ Passwords
  The previous tip will result is a ‘core’ password. Adding at least two numbers and a special character will result in a very strong password. The numbers you use can be from a phone number, address or date. Varying where you put the numbers and special characters will make the password even more secure.
• Never Compromise Your Password
  Make it hard for hackers and never write your password down. If you sign up for a service that sends you an email confirmation with your password printed in plain text, change it immediately. Never give your password away.  If your password is out of your control, so is your personal information.
• For Low Security Sites, Use the Same Password
  Sites that don’t store any personal information don’t pose much of a security risk. If you find that you may need to enter personal information later, change your password to make it more secure.
• Use Extra Security for Financial Passwords
  Each financial site should ALWAYS have its own password. These sites can result in the most risk if your account is compromised. Select the most secure password you can and change it monthly.

/Steve