Another way to get hacked

Seems like half the times that people have come to me with sites that have been hacked it was because the hackers got a hold of their FTP password. Lots of people use the same password for their (non-SSL) email as they do for FTP (bad practice!), database (very bad practice!), and online banking, etc. (steal my identity and assets, please!). Having strong and varied passwords and changing them frequently is an important method of self-defense.

Harvesting stolen passwords has always been a major hacker activity, but this seems like a new twist to me:
Report: Hackers swipe FTP server credentials using SaaS

Gotta love Web 2.0!

Duh!

I started using KeePass Password Safe after I had a hard disk failure last year and lost dozens of passwords I kept foolishly unencrypted in my email client.

It stores passwords in a password/connector protected db. It allows generation of hard passwords and best of all you can drag and drop passwords from KeyPass to a browser and it doesn’t even use the Windows clipboard.

The beauty is you can run this off a USB drive with a single password and it never stores passwords outside the chosen dir.

People should have no excuse not to use strong passwords--just stop trying to remember them all.

I’ve used KeePassX on Ubuntu also, and I like it a lot (especially that it’s open-source and cross-platform: Windows, Mac, & Linux). I actually still keep most of my access data in text files on a network drive, but the really important ones are PGP encrypted. Most of our servers still don’t have SFTP access, however, so anyone sniffing for passwords could easily steal them...

True, for some reason shared hosts think it is okay to allow plain old ftp for site uploads now even though 80%+ people are installing some form of script onto the servers. Forcing users to use SFTP would be much better (except they are storing your password in plain text on their server )