Questions about hijacking web based email

[jimdagys]

I have a hotmail email and also a yahoo email account. Recently, somebody guessed my log- in password and sent out spam to everyone in my address book. Hotmail, with their abilities, shut down my hotmail account and wrote that I needed to change my password to be able to use my account. Then, several weeks later, somebody guessed my yahoo password, and again sent out spam to everyone in my address book. Yahoo didn't do anything (unlike hotmail), but I changed my password.
My question is, how can somebody guess my password? Can someone please discuss this issue, and its ramifications. I'm guessing these hijackers are from China, and get paid a few pennies for each hijacked account.
My own computer, I run Malwarebytes, so I am pretty sure that the computer is free from viruses, however, sometimes I use public computers which may not be clean.

[DB83]

I suspect the easiest way to 'guess' a password is to install a key-logger on a public PC

[dragonkeeper]

More often than not people give would be hijackers their user name and password information. I've seen many times where people will sign up for a free account to a gaming site, porn site etc, the site will require a valid email address for authentication. People are inherently lazy and like to use only one password thus in the process give all their information freely to spammers.

[jman98]

Ah, my old pal, jimdagys, with his usual personal emergency post. Normally I would just leave this alone, but what I have to say is actually relevant to the problem and as over time others will find your post via an internet search, I might as well say this to help them.

Sometimes people don't hack your account. They just get your email address from someone else who's been hacked or from a variety of methods (ie. they got it from some company you willingly gave it to by stealing it from them or paying off some corrupt employee) and send out email faking the sending address as coming from you. It's really easy to fake sending addresses and yes, there are ways to tell it's been faked, but most people don't bother to check. No, I am NOT going to explain to you how to check this. You clearly don't have the IT background to understand the process or you wouldn't keep getting yourself into all the predicaments you do.

Yes, DB83 is certainly right. After all these years you've lived in China I never cease to be amazed at how little you understand the place where you live. Yes, dishonest people put viruses on bootleg flash drives. Yes, publicly accessible PCs often have key loggers on them in China. In China you should assume that EVERYTHING you do on a public PC is being logged by someone.

Finally, it's certainly possible to just guess your password. If your password is something like jimmy6, well, it's not exactly going to take a Cray supercomputer to crack that one. Hackers have lists of passwords and they have ways on some websites to just try every password in the list until they figure out what you are using. Of course I have no idea what your password is. If it's something like X7%qb99*4@ then hell no they didn't guess it. Either they are just faking to be you in the email or they used a key logger.

[MOVIEGEEK]

Never use a public PC for confidential matters, get a laptop or smart phone. Your email accounts have been compromised so get new ones. You might run SuperAntiSpyware on your PC to make sure it's malware free.

[johns0]

With public computers hackers can login in to it remotely and watch people type in their passwords,same way people get hacked logging into public internet connections with their laptops not knowing they logged into a hackers ip.

[lordsmurf]

Somebody gave me a password to an important employee system last week.
The password = 123456

Incredible how dumb some folks are.

[Hoser Rob]

The only public computers that are remotely safe are run sandboxed on their local network. Then if anything does get into one of the machines it's gone when they shut down the system at the end of the day.

A surprisingly good password is 3 or 4 words that have no meaningful connection with one another, separated by spaces. "123456" is just moronic.

Hackers are using phrasebooks now, not just dictionaries. So using a line from Shakespeare or the Beatles won't cut it.

I'm amazed how many people had their email compromised and can't understand how it could have happened because they have an antivirus program. You don't need a virus to phish information.

If there's one thing you need to know about antivirus programs it's this: none of them really work. They all let stuff through. Use more than one anti malware program ... I use MSE for antivirus and have several other on demand scanners ... and scan regularly.

And be very careful what you click on.

Oh, and don't use IE. It's inherently less secure because it's part of Windows Explorer, and as such if you can hack into it it's too damn easy to get administrator level access to the system. Other browsers are regular application programs so it's much harder to get privileged access through them.