If you have an account on a Gawker blog and use the same password anywhere else, it’s imperative that you change those passwords immediately (you can find out whether the details of an account associated with your email address have been stolen here). Use this as an opportunity to set more secure passwords on all of the services that you use. Even if you’re currently breathing a sigh of relief because you don’t have a Gawker account, now is a very good time to review your password strategy.

How to Set Secure Passwords

For a password to be secure, it needs to be difficult to guess, as long as possible and consist of a combination of letters, numbers and characters. It also needs to be unique for each service that you use. The trouble is that the longer and more difficult to crack a password becomes, the harder it becomes to remember, which is why many people use the same password everywhere. The good news is, there are a few strategies that you can use to set secure and unique, yet memorable, passwords:

1. Use a password manager. This is probably the easiest and most secure option, and so it’s the one I recommend. There are several excellent tools available, such as LastPass, 1Password and KeePass, that can generate and store extremely tough to crack unique passwords for every service you use. Because the tool manages the passwords for you, you don’t need to worry about forgetting a tricky long password.
2. Use a password hashing tool. A password hashing tool will take your password, combine it with a parameter (perhaps based on the site’s name or domain) and combine the two using a hashing function to create a very tough to crack password. As the tool deals with the hashing for you, you only need to remember the master password. There are several free password hashers available as browser add-ons.
3. Use a rule-based password strategy. Gina Trapani posted a great rule-based password strategy on Lifehacker back in 2006 (if only all the Lifehacker readers had actually heeded her advice!). The idea is that you take a base password and combine it with the name of the service the you’re creating the password for using a set of rules. For example, my password for WebWorkerDaily might be %shjk80aily% (an easily memorable master password of shjk80, plus the final four letters from the service name, surrounded by % characters for extra security). Applying the same rules, my password for Amazon would then be %shjk80azon%. You can also reverse or reorder the letters from the service name, or interweave  them with the letters from your master password, for even greater security.

All of the suggestions above require you to set a master password. It’s always a good idea to make this as tough to crack as possible; Thursday posted some tips for setting secure passwords here.

Share your password tips below.

Related content from GigaOM Pro (sub. req.):

• Enabling the Web Work Revolution
• Report: The Real-Time Enterprise
• Who Owns Your Data in the Cloud?

You can quickly get an idea of how password hashing works by going to Hashapass. Enter a master password, then enter a parameter for the site/application you want to create the password for (for example, “gmail” or “hotmail”). The unique password is generated from the two phrases and will be very tough to crack.  You don’t have to remember the tricky generated password — all you have to do is remember your master password and the parameter.

Going over to Hashapass every time you want to create or retrieve a password would be annoying, though — and also the generated passwords could use more characters. Fortunately, there are some browser extensions you can use instead. Steve Cooper’s Password Hasher is a Firefox add-on. It can generate hashed passwords on the fly, and allows you to specify options such as password length and whether it should use mixed case, which produces much stronger passwords than Hashapass. (Note that Password Hasher — like many add-ons — has not been updated to work with the Firefox 4 beta)

There’s also a port of Password Hasher available for Chrome, called Password Hasher Plus. It has all of the functionality of Password Hasher, plus it provides inline hashing within the password field — there’s no need to use a pop-up.

One major disadvantage of using a password hashing tool like these extensions is that if you’re on another computer you won’t be able to remember your passwords. Fortunately, you can use an online password hashing tool to retrieve hashed passwords.

How do you create strong passwords?

Related GigaOM Pro content (sub. req.): Report: The Real-Time Enterprise

There was some uncertainty as to whether Apple would okay this app, but I’m guessing that it was approved because it doesn’t change the bookmarks in the iPhone’s Safari browser. Instead, one uses it by opening the Home app, and scanning or searching for tabs and bookmarks, which, when selected, open in Safari. Firefox Home doesn’t track or sync your browsing history on the iPhone. The new Xmarks iPhone app (iTunes link), which I haven’t tried yet, looks to be set up the same way.

To set up the Firefox Home app, you’ll need to create a Firefox Sync account if you don’t already have one, and install the Firefox Sync add-on to your desktop browser. Synced data can be saved on Mozilla’s servers, or you can set up your own server if you want more security.

The app’s design is simple and attractive, and does what it’s supposed to do. I found that the initial sync from my desktop machine took a while, but that’s to be expected, according to the app’s website.

Firefox Home doesn’t yet save or sync passwords, although Firefox Sync does, so I assume that this function will be added to a future release. Meanwhile, you can sync passwords to iPhone using such programs as 1Password and LastPass.

How do you sync browser information to your phone?

Related GigaOM Pro content (sub. req.): What Does the Future Hold For Browsers?

Up until recently, though, one of the challenges with using RoboForm has been easily keeping my passwords in sync on multiple machines. I resolved that issue by using the brilliant DropBox service to store my profiles, which is working just flawlessly for me. I noticed today, however, that the fine folks at Siber are currently beta testing a new service called RoboForm Online.

RoboForm Online utilizes Siber’s GoodSync software to facilitate the backup and synchronization of your password and profile data through their servers. Data is transferred securely between locations, and the encryption of your profile files is maintained. Setting a master password to access any RoboForm data is good practice, even if just used on a local machine.

The benefits are obvious: You can access your passwords in multiple locations as well as maintaining a backup of what is critical data.

Before I discovered and implemented my DropBox sync solution, I would have jumped all over this service. They are a little late to the party, though. Other services like Xmarks (formerly Xmarks) have already gained good traction as options in this space.

For me, now that I already have a workable solution, I don’t see much benefit to moving. But if you’re a current RoboForm Pro user getting started with multiple machines, this is a good option.

I’ve looked at other password management options and I’ve yet to find one that works as well for me as RoboForm. Honestly, the fact that it doesn’t support Chrome or Opera is the main reason I still use Firefox as my preferred browser. It really is the program I can’t live without.

RoboForm Online is currently in a free beta for licensed users of RoboForm Pro. You’ll need your Order ID to register.

Learn more or sign up for RoboForm Online.

How do you manage and maintain your passwords?

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks

This Firefox extension is well-known for synchronizing bookmarks, profiles and more, but the addition of password management makes it a must have for me. At least until Mozilla’s own Weave project becomes more than a prototype.

Secure Password Sync isn’t enabled by default, so you’ll need to activate it once you’ve installed or upgraded to the latest Foxmarks version.

Note that the extension works with Firefox versions 1.5 through 3.0. I’m currently using the beta of Firefox 3.1 for the faster TraceMonkey JavaScript engine and Foxmarks isn’t yet compatible. I had to disable browser extension compatbility for the time being.

Similar to other password sync approaches, your passwords will be stored up in the cloud on the Foxmarks servers. I’m sure that a few eyebrows were just raised in terms of security and that’s a good thing. You should always question the security features of any web application. However, there’s two reasons to lower that questioning eyebrow.

1. To use Password Sync in Foxmarks, you have to create a local PIN, or Personal Identification Number. Without that PIN, your passwords can’t be accessed on a machine with Foxmarks. The key here is that the PIN is stored locally between you and your computer. It’s never sent to the Foxmarks server. Think of it as a front door key that you carry with you.
2. Your password data is encrypted with an AES 256-bit encryption algorithm before it’s passed between any computer and the Foxmarks servers.

Provided that your PIN is never compromised, this is about as secure and simple of a solution you can get for free. While it does require that you use the Firefox browser on your multiple devices, Foxmarks just added a “must-have” feature for productivity on my devices.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks

The first thing you need to do is install 1Password on all the computers where you want to keep the same passwords. (Yes, this only applies to OS X users at the moment – though it seems that you can at least view the password file contents on a Windows box if you know the master password). Next, you need to step up to the most recent beta version of 1Password: open Preferences, go to the Updates tab, and turn on “Include Beta versions”. Then click the “Check Now” button and upgrade your copy of 1Password to the current beta. Remember to do this on all of the computers where you’re running 1Password.

After installing the update, you need to turn on the new Agile Keychain format in 1Password. Open a command prompt and run the command “defaults write com.1passwd EnableAgileKeychain -bool YES” (without the quotes, of course). Now reopen the 1Password Preferences and go to the Keychain tab. Click the “Switch to Agile Keychain Format” button. 1Password will take all of your existing data out of the Apple Keychain and put it in their own data format.

This is where Dropbox comes in. Click “Change Location” in 1Password preferences and move your new agile keychain into your dropbox (you can also use other sharing utilities like SugarSync or FolderShare – the key is to pick something that does automatic bidirectional synchronization).

Now, move to your other computer. Make sure that 1Password is upgraded to the beta version and that the agile keychain is enabled. Then open your dropbox in Finder and double-click on the synchronized keychain file. Confirm to 1Password that you want to load this file, and voila!: all of the passwords from computer #1 will be available on computer #2. If either one adds a new password, it will synchronize to the other via Dropbox.

There are, as we’ve pointed out before, many options for password management. To my way of thinking, this setup – using a native client-side password manager with encrypted synchronization over the web – is one of the slickest ways to set things up.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks

Enter a little bird to whisper a secure, but memorable password in my ear: PasswordBird.

PasswordBird is not going to set the web on fire, but if you’re at a loss for a reasonably strong password you just might remember, it’s perfect. Enter a name, a word and a date that’s special to you, and it will crank out a password that’s easy on your brain cells.

For example, I entered Santa Cruz, which made me think of ocean, which reminded me of March 3rd, 2000: PasswordBird cranked out:

• oceruz2000
• ruz2000ean
• ocesan00

No registration, no request for your email, just the names of the guys who did this (Kevin Sheurs and Andrés Galante) and a couple of unobtrusive text ads. Sweet!

Of course, if you don’t want easy, there’s always PC Tools Secure Password Generator, which will crank out as many as 50 strong passwords faster than you can say rukUke2a.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks