Giving away passwords
This is something that I just thought about when signing up for an account at some shady Russian CounterStrike website. I think the thought has occured to me before, but I think I'll put it up to benefit whoever might be reading this.
Okay, basically it's this: When you sign up for things online, they always ask you for email address right? And if it's an account on some website, they will ask you to choose a password also right?
Now, if you are the type who habitually change your password or come up with a new one each time, then all's fine. But if you are like me, who hates having to change passwords, and always use one out of just a handful of different ones, then there is cause for worry.
Because if you choose a password that is the same as that for the email account you supplied, then nothing stands between a rogue webmaster and commandeering your email account. The password will be in plain sight to him, since it is his website and database. Of course, if it's just email, then it's not too bad. What if your account provides other services than email? eg, knowing your NUS email password, I can then take over your entire account.
At least I have one extra line of defense, by creating dedicated/semidedicated mail forwarders for subscriptions. In English, it means that I provide a different email address for each thing I sign up with online. I told Apple my email is apple@m1.lookingabove.com; I told Microsoft it's msn@wei.lookingabove.com; I told the shady Russian website that it's russ@m1.lookingabove.com. Why? Because those aren't real accounts. Emails sent to them get forwarded to my real email. I did this to protect my email from spam (I can delete and bounce mail to any of the addresses if it gets spammed) but now I realise that it protects me from more!
Okay, not everyone has his/her own hosted domain and unlimited forwarders ... though I think everyone should get one!
So what can you do? Like I said, if you are always changing your password or coming up with new ones, you're fine. But if you are a creature of habit, let me propose this: devise a simple system of coming up with unique passwords for each thing you sign up with. For example, the system can be this: add the number 90 to a shortened form of the website's name. So for apple.com, your password is apple90, for yahoo, it's yahoo90, for shady russian websites, it's russ90.
Intuitively, yahoo90 feels unsafe. It feels ... obvious. Okay, for those really important accounts with trustworthy websites, you jolly well use a really really unique password (even if it's one you use over and over). It's perfectly safe to do so especially if they don't ask you for your email address. Like Yahoo! since it gives you one.
Don't like that method? Well, to make the passwords more complicated but still habitual enough, you can alternate between the website name and a fixed number ... For example, the website is Apple and the fixed number is 15, so the password chosen will be a1p5p1l5e. Shady Russian website? r1u5s1s. Let me just tell you: passwords like this are completely unguessable. But i'll tell you, for those unimportant signups, don't bother ... like I said, the webmaster can see your password if he wants to anyway. You are protecting your email from him!! So, it will be russ90 for me ....



