Passwords are there for a reason, they should make sure you are the only one to access your accounts, however, many don't really bother about other people knowing their passwords.

Mostly, they're saying "they don't have anything to hide anyway" - while that might be true, there is more behind all this.

First of all, people who are trying to get your password mostly do it for fun - they want to ruin your reputation, have an account to mess around with, or snoop around in your notes. Really, they enjoy this. Once they get in your account, they will probably start deleting your gallery, with all the comments from caring friends, who took the time to write you, favourites and everything else you received, being gone. Usually they would also post an embarrassing journal and do other weird stuff, making your friends all puzzled, but sometimes it doesn't stop there - they might be looking around in your notes, seeing if they can find anything others should not know and post that in the public (maybe your journal), they might upload embarrassing images, they might start insulting your friends, who might, depending on how they approach all this, think it's you saying those words, will get scared and all that stuff, and last but not least, they'll also try your password on other sites you are on - in short, there is a lot of damage that can be done with one's password, trust me - and be it "just" losing your reputation and getting your friends shocked.

By the way, believe me, saying "I'm rather unpopular, it won't happen to me" is not quite correct - especially if you are unpopular, people might try guessing your password, because they assume you use an easy one. And if you're popular, people will just try because of your popularity.

There are a couple of ways one can get to your password - one of the easiest is simply guessing it .. many people's passwords are incredibly simple, so it only takes a couple of tries to get them .. simply using "password" or writing your name in a certain way (backwards) is one of the first things someone will try.

The second way is, simply using a dictionary and trying every single word in there - programs can do that fast, and will try thousands of entries in mere hours, automatically. There are dictionaries containing around 200 to 300 of the most popular words and names used as passwords, but there are also more elaborate ones having several ten-thousands of entries. This way to get your password is called "dictionary attack" - in short, if your password is in a dictionary, this will gain them access to your account pretty fast too.

Another way of getting to your password, is called "social engineering" .. these are people, who will contact you by some way, either through mail, AIM or similar and tell you, they're staff members and you need to give them your password for some reason or another. Usually, when they're claiming to be staff, they will tell you that you'll get banned or frozen if you don't give them your password.
The fact is, that a staffer will never need your password. Neither will you be asked for your password via e-mail or chat - never. If a staffer really needs to check something on your account and they're authorized to do so, they can look around directly in the account database (and the excuse used by some people who say "the account database is damaged and that's why we need your password" is the oldest there is).

To get you to hand over your password, there are a couple of other tricks too - the most common one is that you somehow get a link for a site you know, either from a person, or in an e-mail .. and when you click it, you'll get taken to a site that looks exactly like the login-page of the site you usually go to, only that it isn't, and the username as well as the password simply gets sent to the one wanting to get in your account. For example, for neopets, you might get an e-mail saying you got a rare item and you have click a link to actually receive it, but when you click it, you get to a site looking like the neopets sign-on page (maybe even saying "for security reasons we have to verify your password again", and when you enter your password there, someone else receives it and will mess up with your account big time.
For deviantArt, you might get sent an e-mail that someone sent you a note (with a link you have to click, of course - surprise, surprise), or anything like that. Of course, one could also just make a site saying "Test How Secure Your Password Is" - as soon as you enter it there, they have it.
Another common trick is to give you a program to download, telling you to change your e-mail address of your account to something else, or telling you to send an e-mail with your username and password to a certain address, so you can get really rare items, and loads of neopoints .. but instead they get the password, logon to your account, take or donate your items and neopoints, and abandon the pets .. you can actually find a couple of those tricks here (don't fall for them!) .. if you do anything of what they say there, your account is pretty much lost - since you're handing them your username and password, and if you change your e-mail address to the other one (which is their's, surprise ;P ), they just use the "Forgot Password" tool to get neopets e-mail a new password to their address ^^;

The easiest way to see that you're being tricked, is by looking at your browser's address bar. What is relevant there, are the words from the last two dots (including the dot) before the first slash (/) after the obligatory http://. For example, on deviantArt, these words have to be ".deviantart.com/", on neopets they have to be ".neopets.com/" - otherwise it's forged.
For example, look at the following addresses:

• http://secure.daMailVerify.com/deviantArt.com/login: this one is forged, because the first two words before the first slash are "daMailVerify.com" - whoever would be owning the domain, it's not deviantArt and you would be handing over your password.
• http://my-deviantart.com: this one's a different site just as well. There is in fact a site "my.deviantart.com", but the hyphen makes the difference - it's all about making the address look similar and find someone to fall for it - it's the dot that counts.
• http://www.neopets.com@193.231.221.256/sign-in/ : this one is forged just as well, because the first "words" are an IP address, and not neopets.com - in fact, everything before the "@" sign is effectively ignored. Try going to http://www.neopets.com.@icyworlds.net/, you will see my page instead of neopets'. Of course, you'll recognize it from the design, but one could as well make it look *just* like neopets'. The protection that neopets (in particular) has (showing you your active pet and its name) is something nice, but can be bypassed easily as well, since the information on who your pet is can quickly and easily be queried from the search form (note that more decent browsers, such as Firefox, will warn you if someone tries to trick you that way, many other browsers will just let you fall for that trick)

If you are in doubt, and you think anything's fishy, the best thing you can (and should) do, is - as soon as you see a login form you didn't expect, go to the site directly, like "www.neopets.com" or "www.deviantart.com" and log on from there - that way you can make sure you don't hand over your password on a silver tablet.

So, how would you make a secure password, besides following all this and not simply handing it out? First of all, the best and most secure passwords are random passwords: type a few letters with closed eyes, then throw in one or two random numbers, maybe even some weird characters such as $ & / + @ or #, and finish with a few other letters. However, they're pretty hard to memorize (if only for the first ten times you have to enter your password, after that you're pretty comfortable with it), so ff that is too complicated, try using a proverb or a sentence and take every first (second, third, ..) letter of it, capitalizing nouns. Then, add a few (two to three) numbers to it, and if you want to be extra safe, maybe one of the weird symbols - these make very secure passwords too, and pretty much all attempts to guess such a password will fail.
Last but not least, of course, the password should be easy to remember for you - you shouldn't have to write it down, and you shouldn't forget it easily (however, it shouldn't be an easy password either, as said above).
Also, if you see someone telling you to change your e-mail to something else, such as - simply write an e-mail to the abuse team - on deviantArt, you can go to the HelpDesk, on neopets you'd use the abuse form, and they'll take care of that really soon, getting the e-mail address closed (so noone else could fall for the trick and sending them their password either).

Last but not least, you shouldn't write down passwords, and you should not give it away, neither to good friends, nor to family members. That's no question of trust or anything, a password is yours and yours only. A real friend would never ask you for them - and half of the cases we receive about someone losing access to their accounts (the password and the e-mail addresses changed), is because a "friend" of theirs got mad at them and decided to go on a rambage. Putting it simple, friendship or trust isn't a question about letting them know your password at all. Real friends or trustworthy persons don't even think of that.

That's all, I guess ^^ In short, all of this should have given you a short overview of how people currently try to get one's password and how you can protect your work and effort from that. Take care, all of you. ^-^