Gawker Media is an online “news” organization.  Except for Lifehacker (which I really like) it’s kind of the supermarket tabloid of online media.  You may know Gawker from Gizmodo (the site which bought Apple’s stolen iPhone 4 prototype.)  Anyway, Gawker had a significant security breach, which has resulted in a leak of their authentication database.  You can read Gawker’s FAQ on the issue here, or some excellent coverage on their problems at Forbes.  In addition to the usernames and email addresses of all their users, the database also contained encrypted passwords.  Encryption is meant to be reversible, and hackers have started unencrypting the password database.  Some 200,000 passwords have already been decrypted, and many have been shown to be simple things like “password”.  Modern computer science dictates that authentication schemes shouldn’t store encrypted passwords, they should store password hashes.  Password hashes are one-way.  They can be used to determine that a user has typed in the right password, but there’s not a way to get a password back from them.  Their second large mistake was using a very old encryption standard, which has already been cracked.

So what does this have to do with you, especially if you don’t have an account on their system?

The first lesson from us is to not trust sites where we are creating accounts with passwords.  Their site design and site security may not be as good as we think.  This could lead to the exposure of your information, including your password for their site.

Which leads us to the next lesson.  Never.  Never.  And I mean NEVER, use the same password for multiple sites.  If you’ve used a password for site A and site B and site A is compromised, then they have your password for site B.  User’s are already experiencing this from Gawker’s breach.  A number of very odd tweets have gone out from users who have had their password decrypted.  Because of this risk, at least one site (LinkedIn) is proactively expiring passwords for the users on Gawkers list.

The third lesson is to use long and complicated passwords.  The passwords which have been recovered so far are simple and common passwords.  When the hacker is decrypting a string, and gets back password, it’s clear they are done.  When they get back adIop87H23f874gV58  they aren’t quite so sure.

But how am I supposed to remember all those different complicated passwords?  You should write them down.  Or use an application.  It really depends on your needs.  There are a number of different applications out there, and they are all a little different.  Obviously you need to trust them, so don’t take the decision lightly.  You could use a little book, and really write them down, just make sure your book is kept secure.  If the book never leaves your house, you’re probably ok.  If someone gets into your house, they aren’t there to steal the password to your Facebook profile.  There are two passwords which shouldn’t be written down, should still be long and complicated, and must be memorized.  The first is the password to your computer.  The second is the password to your password system.  There’s one more password that is especially important to keep secure, your email password.  Your email account is the gateway to all your other accounts.  If your email account is compromised, hackers can use that to request new passwords to most sites.

A lot of the applications have the ability to generate random passwords, but in case yours doesn’t, I’ve built a quick Excel spreadsheet which will generate random passwords.  Password_Generator

Go now.  Get a password system if you don’t have one, and start changing your unsecure passwords.