Because of the way HTTP works, when you type in your username and password into a web page to log in, what happens is your computer sends your username and password over to the web server, and the web server checks if this username/password pair exists in its database and if so, grants you acess to whatever it was your were trying to access. There are several problems with this system, one of which is that if someone "eavedrops" this transaction, they now have your username and password and can log on as you and do all sorts of crazy stuff to your account.

A better system would be if the web server randomly generated a number (let's say 483948023), stored that number in a text file, and then encrypted that text file using your password, and then sent you the encrypted form. Upon receiving the encrypted file, you decrypt it using your password, and get the number "483948023", which you then send back to the web server. The web server is convince that you do indeed know the password and so lets you in. See, if someone were eavesdropping, they would only see "483948023", and not your password. So if they tried to log in as you, the web server would once again generate a random number (perhaps "03919283"), send it to them, and then they'd have to way to figure out how to decrypt it, since your password was never sent.

This second method is called "Challenge-Responce" because the server sends you a challenge (that presumably only you can solve), and you send the answer to that challenge, called the responce. Unfortunately, the web wasn't designed to make Challenge-Responce easy to implement. You'd probably have to download a plugin for every different site that wanted your password, and that would be inconvenient, which is why it's not done, and we all have to just live with the fact that the web is very insecure.

This is why it's a good idea to use a different password for everything: If someone eavesdrops and gets one account, they'll only gain access to that one account, since every other account uses a different password. If you use the same password everywhere, then they only need to eavesdrop at one location to gain access to everything. BTW, if you use the same password everywhere, don't tell anyone that. It'll just make you a more worthwhile target for attack. A cracker, not knowing who uses the same password everywhere and who uses different passwords everywhere might just try snooping around randomly. But if he knows that certain people use the same password everywhere, he'll try to concentrate on snooping on that one person in particular, because that password is much more valuable (it unlocks a lot more accounts).

One of the most insightful advice I've ever received is "Don't bother trying to create a secure password that you can remember; if you can remember it, it's easy to crack." To understand why this is the case, take a look at how fast computers are becoming these days. Intel says a 4.0Ghz CPU to consumers (I'm going to assume you're not trying to protecty our data from people who have access to super computers) That's 4 billion calculations per second. You can even get motherboards with dual CPU support, so that's 8 billion calculations per second. Some people might own more than one computer (I have 3), so their computing resources can easily reach multi-billion calculations per second. Let's saying that it takes 20 or 30 calculations to verify if a password is correct, so that's about 1 billion password verifications per second. That means in 1 second, a cracker can try 1 billion different passwords when trying to crack your password.

If your password is easy to remember, it probably only consits of characters, and probably doesn't mix cases. Furthermore, it's probably shorter than 12 characters long. Since there are 26 letters in the Latin alphabet, and assuming you're doing the best case scenario of a 11 letter password, that's 26¹¹ possible passwords. 26¹¹ / 1 000 000 000 = 3 670 344.49 seconds, or about 42 and a half days. That doesn't even take into account the fact that if your password is pronounceable, certain letter combinations (such as "qz") is less likely than others (such as "ne"). By only using "pronounceable" passwords, the cracking time can be reduced to as little as 12 hours.

If you want to live safely on the web, my recommendation is that you get a "password manager" which stores all your passwords for you, and you use extremely difficult to crack passwords. Password Safe is a free, open source password database. From the website, "Password Safe is a tool that allows you to have a different password for all the different programs and websites that you deal with, without actually having to remember all those usernames and passwords. Password Safe runs on PCs under Windows (95/98/NT/2000/XP). An older (but fully functional) version is available for PocketPC."

If you start using this program, I recommend you stick with whatever password generating scheme you've been previously using (e.g. if you've been choosing DDR songs as your passwords, continue to do so). The reason for this is that nothing sucks more than finding out you don't like a password manager, deleting it, and then realizing that the password manager contained passwords that you can't remember manually. After a few months, once you're sure you're happy with your password manager, you can start to use a more secure password generation scheme, one that's impossibly difficult to remember but very secure. The "impossibly difficult to remember" part won't be an issue anymore, because your password manager will remember the passwords for you.

One generally secure way to generate a password is to do make it completely random. Have a computer program randomly choose a sequence of letters, numbers and punctuation for you. MAKE SURE THIS PROGRAM IS OPEN SOURCE! I can't stress this point enough. Random password generators are extremely easy to write; so much so that it could easily be a trivial homework exercise for someone's first programming course. There is no "industry secret" type value in keeping such a program closed source. You want to make sure your random password generator is open source so that it is not secretly injecting patterns (such as only choosing odd digits, when it uses digits in your password) into your password.

Typically, such programs will let you specify how long you want your password to be. I'm going to help you walk through the process of figuring out a good length. For those who are lazy, 12 is a good length. The reason why 12 is a good length here, and not before is that I'm assuming you're going to be using a purely random password, with mixed case and numbers.

The first step is figure out how long you want your password to be secure. No password is "eternally secure". The longer you make your password, the longer it'll take to crack it, but given enough time, it will be cracked. I think 100 years is a good length, because few people live longer than that.

Now, computers keep getting faster, and they get faster exponentially. A rough estimate is that computers get twice as fast every 1.5 years. So in 100 years, computers will have doubled in speed 100÷1.5 ≈ 67 times. So if a computer can currently before a billion password checks per second, in 100 years, it will be able to perform 67 billion password checks per second.

Now our password will probably contain a mix of uppercase and lowercase letters and numbers. That's 26 + 26 + 10 possible characters, which means 62 possible characters. If our password length is L, then there are 62^L possible passwords of that length.

Since the fastest computer we'll ever have to worry about can perform 67 billion password checks per second, the amount of time that computer will take to check every password of lenght L is 62^L÷67 000 000 000 seconds. Let's call this value T, so we have 62^L÷67 000 000 000 = T.

We want to solve for L. After cross-multiplication, we get: 62^L = T×67 000 000 000.

Using a logarithm to get rid of the exponent, we get: L = log(T×67 000 000 000)÷log(62).

We want T to be equal to 100 years. When I give Google the query "100 years in seconds", Google gives me 3.1556926×10⁹ seconds. Plugging that into the equation, I get: L = log(3.1556926×10⁹×67 000 000 000)÷log(62)

Plugging that into Google, I get 11.3396919, which gives me 12 when I round up. Note that it's very important to round up, because if you round down to 11, that password can be cracked in a little over 24 years.

Note that if your password uses punctuation or other characters, you can use a shorter password while still being secure.