If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how can I secure myself?
Your ISP can know your password any time it's sent unencrypted over your internet connection. If you don't want them to know your password, don't send it unencrypted over the internet:
- Avoid login pages that use HTTP (always use HTTPS and don't visit sites with expired or invalid SSL certificates)
- Don't use FTP or other services/protocols that don't encrypt your password in transit
Also follow general security guidelines for passwords, such as never reusing the same password.
Additionally, if you are worried that your ISP (or anybody else in between you and the remote server you're communicating with) is watching you, then you also need to take additional steps, such as:
- Ensuring that all websites you are logged in to are using HTTPS, so that your cookies can't be snatched from the HTTP request (you're logged in to this site, where HTTPS isn't available, so your ISP can already log in as you here if they want to)
- Verifying you are talking to the right server (for example, with SSH, ensure you use fingerprint verification and take notice if a server's fingerprint changes).
If you are only worried about your ISP (or your government), you can improve your position significantly by using an offshore VPN so that all of your traffic is routed through a server outside of their reach. Your data will still be sent unencrypted over the internet, but will be encrypted between the VPN and you, which is enough to prevent your ISP from reading it.
If you are not using HTTPS, then your passwords are at risk of interception. Using a VPN or an encrypted proxy means trusting the VPN and proxy provider. Only HTTPS can provide (as far as we know) reliable security without trusting anyone external. But attacks that weaken the SSL/TLS protocol exist, such as BEAST, CRIME and TIME.
You have to make sure your are using HTTPS on websites that have your sensitive data. Banks and Google will use HTTPS but for others, you have to configure them to use HTTPS. Facebook is a website that doesn't yet have HTTPS for everyone by default but you can turn it on using a few clicks.
HTTPS Everywhere is a Firefox and Chrome extension that encrypts your communications with many major websites, making your browsing more secure. "HTTPS Everywhere" makes sure you will not use the unsafe HTTP when HTTPS is available.