Russell Henley

Maidenhead

IT Consultant

Online identity fraud is a lot simpler than some people believe - when you enter your email address + password into many websites you have no idea whether or not that password has been encrypted or whether any staff running that website can see it.

As a developer I've seen plenty of sites where passwords are stored in plain text rather than using basic MD5 encryption, or ideally MD5+SALT encryption.

If you use the same password across several sites, you are relying on the security of the weakest, not strongest, link in that chain. If someone manages to hack one site they can try and use your details on several other (e.g. ebay, paypal, banking etc. etc.).

I always use a different password for each website, although often pick something easy to remember based around the site name. And I don't have a text file on my desktop that says 'passwords.txt' either(!)