2

I recently had one of my accounts compromised after falling victim to an online phishing scam. To make matters worse, while I've used unique passwords for any account created in the past few years, my 14 year-old self made the critical mistake of reusing passwords between multiple accounts.

Since then, I have received emails from several sites warning me of login attempts from unauthorized sources. To keep my account secure, I'm now faced with the arduous task of resetting passwords for nearly 280 different accounts.

I've attempted to use LastPass's Automatic Password Reset, but have had limited success. It requires manually checking which sites are supported, lacks an option for resetting multiple accounts at once, and sometimes fails to register successful password resets.

How should I go about resetting multiple account passwords after a security breach?

2

Since there are many different ways in which password reset functions can be implemented, the only real option is spending some time going through resetting them manually. Yes, it's a pain, but once you're done, you're not going to be worried about the same problem again.

At the very least, prioritise accounts - if you've not used them for years, there is probably less urgency than for something you use regularly, or your email account, for example.

1

Start by making a list of most important accounts. You say you have 280 accounts. How do you know this? Do you already have a list?

What I would do is the following:

a) Change the password for accounts that you use for authentication. For example, a main email address where you receive password reset mails. Or if you use your phone for two-factor, change the password that you use to log in to your phone provider's website. Make good passwords, store it in a password manager, but also remember them.

https://www.schneier.com/blog/archives/2007/01/choosing_secure.html

b) Change passwords for really important stuff. Things that involve money or access to really valuable resources, like your bank account, or your AWS cluster, etc. Try to remember accounts that are linked to your money, such as software for games, or an app store. Make good passwords and remember them, or generate them using your password manager if you can reset the password, and store the password in the password manager in both cases.

c) Go change accounts for social media and other stuff that holds your personal information.

d) Continue going from important to unimportant until you get bored. Eventually, for the unimportant stuff that doesn't really hold value, you can either reset the password when you bump into wanting to use the account, or just make a new one.

Now I don't want to make you paranoid, but you might want to add a simple virus scan before changing things. I don't know what kind of phishing trap you walked in to, but you should change passwords from a clean device if you got infected with malware.

Last but not least: activate two-factor where possible.

  • I have a complete list of accounts stored via LastPass. My LastPass password is unique and has never been reused. – Steven M. Vascellaro Jul 5 '17 at 21:01
  • Neat. I would go through it, and categorize all accounts that use the compromized password into the four categories I mentioned. Then change them accordingly. – Graa Jul 5 '17 at 21:06
  • 1
    "Make good passwords, store it in a password manager, but also remember them." The memory part isn't realistic for a human with 280 accounts. – PwdRsch Jul 5 '17 at 23:02
  • That's only for the critical accounts PwdRsch. – Graa Jul 6 '17 at 9:14
0

I ended up using LastPass's Security Challenge to help me identify weak and reused passwords between different sites.

I still had to take the time to manually change my password on each site, but LastPass saved me a lot of time listing which passwords needed to be changed.

LastPass Security Challenge

  • I don't understand how this helped you. You said you reused passwords between accounts, so presumably you had to change all passwords on all accounts where you did this. How specifically did LastPass' Security Challenge make that easier for you? – PwdRsch Jul 20 '17 at 15:33
  • 1
    @PwdRsch I only reused passwords on my older accounts. I used unique passwords for any account created in the past 4 years. LastPass helped me track how many passwords still needed to be reset. It's not a complete "solution", but it may be helpful for others in a similar situation. – Steven M. Vascellaro Jul 20 '17 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.