I accidentally entered password for a website as a username for another website

Question

First and foremost, I am sorry for posting anonymously for security reasons. Exposing my identity might mean exposing my vulnerability, which comes from the problem decribed below.

I have accounts in websites A1,A2,A3,...etc with password X or derived from X in some pattern.

When registering at website B, I accidentally entered X in the username field. The registration flow was: I entered my email address, I clicked the link in the email they sent, and then they ask a username, which I mistook as a password field. They didn't ask any other information, so right after I entered X as username, I was registered.

The problem is:

1. X, my password for A1,A2,A3,...etc is stored in plaintext, and
2. in website B, username is public, which means everybody can see X.

One obvious solution is to change my passwords for A1,A2,A3,...etc. However, it can only be done to websites I remember. I might miss a lot of websites in which I have an account.

Website B doesn't seem to have a mechanism to change username or delete account. I have tried contacting them however there are issues with that:

1. The technical support claims not to understand my explanation of the problem
2. There might be some restrictions which prevents them from changing my username or deleting my account.

Is there any possible solution for this?

Answer 1

That sucks. I can't think of any other possible solutions beyond the ones you listed:

1) Keep at the technical support to delete the account (fully delete from all databases). This is probably your cleanest option.

2) Go around changing your password everywhere. I recognize this is a pain, and impractical / impossible for websites that you don't remember having an account on.

---

The main reason for posting an answer is to highlight your unfortunate situation as a warning to everybody else:

USE A PASSWORD MANAGER!!!!!!!!!!!!!!

This situation would have been completely avoided had you been using a password manager for all your accounts.

Had you pasted a newly-created random password into the account name field, then you go "oops", generate a new random password, and start the account registration over again (or live with a username like huWb9EIaemGZqVsp3aYV).

Even if - for some reason - you don't like random per-account passwords and you revealed a password used by multiple accounts, your password manager is a list of all your accounts, giving you a nice list of which are using that password and need to be cleaned up.

---

Finally, let's address:

I have accounts in websites A1,A2,A3,...etc with password X or derived from X in some pattern.

Your situation is a great example of why "a password derived from X in some patterns" is essentially equivalent to "a password X".

I wish people would stop trying to be clever with patterns, and just used properly random passwords. (sure, password managers have usability issues, but they are far less risky than memory-based tricks)

Answer 2

Your password X on site A1 was compromised not when you accidentally submitted it as a username to site B, but as soon as you submitted it as a password to site A2, and additionally when you submitted it to site A3, etc. Any attempt to get site B to delete it simply increases the exposure by repeating it in emails, support tickets, etc.; it won't undo the exposure on site B much less on A2, A3, etc.

The only course of action to remedy this is to change your password on all of these sites to something unique to the site, preferably randomly generated and stored with a password manager. If you don't know all the sites you reused password X on, you at least need to determine which ones have accounts of sufficient importance that compromise would cause significant harm to you, and change those.