How can I protect my information (passwords) while using a proxy/VPN?

It gets complicated, unfortunately.

A proxy is just a generic term. It's a device/software that's used to filter content, get around a firewall, redirect urls, etc. Some offer encryption, some don’t. It just depends on what it’s trying to accomplish. You can think of a VPN as a “special case”, a proxy that always uses encryption, although rarely offer others services (e.g., content filtering). A VPN just creates an encrypted tunnel between two endpoints and over which you can safely pass your traffic, free from eavesdropping.

But proxies are not a pancea. Even when encryption is supported, at the other end of that proxy the data MUST be decrypted before it can be passed on to its final destination. So even though eavesdropping is prevented between your machine and the proxy, you are implicitly trusting whoever is at the other end of that proxy!

IOW, all the proxy does (at least one that supports encryption) is “shift” the area of potential vulnerability to somewhere else. In some cases that’s sufficient and perfectly reasonable because you’re dealing w/ a proxy you can trust (e.g., the VPN server at your place of business, or your own back at home). But if you’re using a commercial VPN service, say StrongVPN.com, you’re simply taking it on “faith” they can be trusted. Whether such faith is warranted, you have to decide.

So the way to protect yourself is to either use proxies you know can be trusted, and/or secure protocols (e.g., http (SSL)). That’s why it’s usually quite safe to engage in online banking, proxy or no proxy, because your data is already encrypted before ever enters the proxy, and remains encrypted when it exits the proxy. So if you do your online banking over a proxy which supports encryption, and you’re using https (SSL), you’re actually encrypted TWICE! The only one who can ultimately decrypt it (in this example) is the bank!