Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With so many websites with unique login systems, is there a way for me to track, and improve the quality of my login credentials on various accounts while limiting the risk of someone gaining access to this information, and my accounts along with it?

share|improve this question
Why wouldn't you just always create accounts with strong passwords? Or use a password management utility like last pass to generate strong passwords. Although I personally prefer to have direct control over my passwords myself. – EBGreen Aug 15 '12 at 14:49
Well, when you've been creating passwords for years before Lastpass existed, it's an issue you should look into at some point. But say you look at your lastpass vault, there's not a good way to determine password quality over multiple sites, and when you have logins for ~100 websites, auditing becomes an issue. And since it's not recommended to store your login accounts with associated passwords in plain text on your computer, having a secure tool for the purpose of auditing your password quality across accounts would be useful, especially for accounts that you don't use often. – Shawn Furyan Aug 15 '12 at 15:16
I didn't really answer your first question though: "Why wouldn't you just always create accounts with strong passwords?". I hadn't seen it as possible to manage credentials that include strong passwords (where one of the biggest requirements for a password to be considered strong would be that it's unique) for all of the websites that I need login credentials for before the existence of Lastpass. My best attempt at account security was to duplicate one unguessable password over many accounts. After I started using lastpass, this was no longer true, but I still have those pre-Lastpass accounts. – Shawn Furyan Aug 15 '12 at 15:22
up vote 2 down vote accepted

You could, temporarily at least, install LastPass and enter (or let it import) your existing passwords. Afterwards you could use the Security Check item on its Tools menu to do what you want.

This launches the LastPass Security Challenge which analyzes the items stored in your LastPass Vault and ranks them on a scale of 0-100.

a screenshot showing the Tools menus sub-menu items

share|improve this answer
This is the solution I had in mind. It works very well. – Shawn Furyan Aug 15 '12 at 18:02
Yes, it does, and I think it offers to do this for you when you first install it -- not sure, it's been awhile since I did that. – martineau Aug 15 '12 at 22:22
I recently installed lastpass on my wife's laptop and work computer, Windows 7 and XP respectively. It didn't offer this option. It's been a while since I last installed it on Linux, but the Windows installer always seemed like a higher priority product, so I would be somewhat surprised if it offered the feature. – Shawn Furyan Aug 16 '12 at 1:29
@ShawnFuryan: When I installed in on my mother's Mac not that long ago, seems like it did offer to run a Security check. On the other hand, I don't remember encountering that while installing it on a friend's Win7 system very recently. Maybe I'm imagining things... – martineau Aug 16 '12 at 1:43
I suppose I could have missed an option. Perhaps the installer's behavior is different if you're making new account vs. using an account that already exists. In any case, this answer shows exactly where it is, so it doesn't really matter much for anyone reading this, haha. – Shawn Furyan Aug 16 '12 at 6:34

I have this problem too, but I've been living with it by just unconditionally changing all of my passwords that I KNOW are the same, and every time I find myself typing in or copying a password from somewhere, I mentally determine whether that password is secure or not (i.e. unique, long, and unguessable). If it's insecure then I take the time to change it right then and there. I also use LastPass, like you.

I understand your motivation for this, certainly, because so many websites and services are getting hacked these days and having passwords which are only lightly salted or hashed being stolen. So it can be devastating if you share the same password, no matter how complex, among different sites and just one of those sites gets hacked.

What would really be ideal is if LastPass implemented something like this, because they could have their program run this analysis for you in memory (or on their secure servers) and tell you which passwords are weak and which passwords are duplicated across sites. I know this is impractical to do manually, because finding duplicates is an O(n^2) problem, which takes much longer for a human to do than a computer, especially if you have hundreds of accounts like I do.

But here's my recommendation: stop pursuing this problem, unless you want to convince the LastPass devs to implement it. If you're looking for some kind of custom program, let me explain why I don't think this is a valuable use of your time.

To put it simply, your passwords are probably currently stored in one of several possible places:

  • On paper;
  • In LastPass;
  • In some kind of offline password manager such as KeePassX.

Regardless of where they are stored, the fact is that the programs / places they're stored in right now do not have the "password-duplicate / weak-password-finding" feature you are looking for.

So the problem is that, even if you found a perfectly viable program with exactly the functionality you want, you'd have to hunt down ALL of your passwords and manually type them (accurately) into the program before you could make good use of it. Unless, on the extremely rare chance that KeePassX or LastPass has a plugin architecture, the program could read from your existing password store (not likely, for security reasons).

So, if you have a LOT of passwords, and you don't have time to manually duplicate-find by examining each password in turn, and your current electronic password store(s) do not have the functionality you want, it would take almost the same amount of time to accurately key in all the account usernames/passwords that you currently use into another program just for the purpose of finding duplicates... so it wouldn't really be a winning solution either way.

The best way "for us" (us = people who already use LastPass) would be to have them implement the feature the way we want it. Lacking that, I think the incremental approach of "change them as and when you use them" is the least tedious.

share|improve this answer
Actually, you you stumbled upon the answer that I had in mind when I asked the question (but since I've had a read-only relationship with Superuser, I have to wait 8 hours to write an answer. Lastpass actually has already implemented this feature, and it's spectacular. I thought that the fact that this wasn't addressed on superuser was a pretty significant hole in its knowledge base, so I wanted to point it out. Have a look: Lastpass Security Challenge – Shawn Furyan Aug 15 '12 at 17:58
Heh... no wonder I didn't know about that feature of LastPass; it isn't on SU! :) – allquixotic Aug 15 '12 at 18:00
Perusing the authoritative LastPass User Manual would have likely taken less time to do than typing in your answer. See Security Check in the the section about the Tools Menu. – martineau Aug 15 '12 at 22:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .