87

I have a lot of online accounts, web services, and so on -- personal as well as business -- so obviously(?) I use a password manager to handle them all. Specifically I use Lastpass but my question applies to any and all:

Given the Heartbleed problem and related questions, even if I wanted to change all my passwords (and shouldn't we all be doing that at regular intervals??), how in the world can I change so many passwords in an efficient manner?

If I have to visit each service and site individually and change the PW manually, it's clear that it will take a weekend of dedicated work ... password security is good and all but that's just not practical.

Update: I just used Lastpass's "security challenge" which reports that I have 274 sites and a security score over 83%. Several intranet sites at work reuse the same pw which significantly lowers my score. All my Internet accounts score above 92%.

8
  • 6
    Please read this fine literature before changing all your passwords: security.stackexchange.com/questions/55283/…
    – MonkeyZeus
    Apr 9, 2014 at 19:43
  • 4
    I'm glad you enjoyed my humor :) but in all seriousness there is no easy way out. And I think you may have missed the main point of my link which is this section: Changing passwords on a site that is/was vulnerable to Heartbleed is only effective after
    – MonkeyZeus
    Apr 9, 2014 at 20:08
  • Referencing this question on Information Security: API to change passwords?
    – unor
    Apr 11, 2014 at 18:07
  • 1
    good thing that we're now moving on to OpenID/OpenAuth based signon. All you need is just change the password for the identity provider and the rest is on the individual websites. Also, do note that it's only worth it to change password for sites that have already updated their OpenSSL library; probably a good number of those 200 websites you have never makes any updates on their system even in the face of Heartbleed.
    – Lie Ryan
    Apr 12, 2014 at 20:52
  • 3
    Congratulations on being the one user that actually uses different passwords for each different service.
    – jfa
    Apr 14, 2014 at 0:22

12 Answers 12

61

Honestly, there is none. Not unless they offer an API where you can do remote management on your accounts. Pick and choose. Which ones are the highest priority. Bank for example you should change. Forums and other media sites could be ranked lower and changed on a need basis.

PS: I also think people are blowing this heartbleed way out of proportion.

3
  • 1
    Comments have been purged. Super User is not a discussion forum—comments should be used to ask for clarification (which should later be addressed in the answer) or point out issues in a post. If you want to talk about Heartbleed, Super User Chat would be the best place. Thanks.
    – slhck
    Apr 12, 2014 at 11:31
  • ^ @slhck I suggest they discuss it in a special room for IT Security or suchlike, to avoid overwhelming the regular room. Can you post a link to suitable room?
    – smci
    Apr 12, 2014 at 23:23
  • @smci I believe that our main room is actually well suited for that kind of discussion. We usually don't enforce any topics. Information Security also have a chat room.
    – slhck
    Apr 13, 2014 at 8:09
12

I'm curious what kind of answer you expect to get... A piece of software that cascades password changes over various protocols, sites, procedures, etc.? I'll bite my tongue on my opinion of the cost/benefit of actually changing all those passwords, considering any one of them could be cracked in a reasonable time frame, regardless if they are compromised. Instead, I'll recommend you gather contact information for each of these sites and services. Then send an e-mail to all of them requesting your password reset or to re-establish a new password on next login. I don't see any other shortcuts here.

1
  • 8
    A lot of websites likely will send a reply back stating "If you wish to reset your password, please click on the following link: password reset link".
    – Nzall
    Apr 10, 2014 at 8:45
11

Since your question probably doesn't lend itself to an easy answer, I would propose that you change the passwords of websites based on how vulnerable they make you (loss of money, loss of privacy, loss of reputation, etc.)

7

I will probably:

  • review the list for sites storing truly sensitive information
  • change those as soon as it seems clear the site is ready for that
  • change the remainder the next time I use the site or if the site requests/forces a change.

This means some of them will never be changed, because I will never use the site again, and that's the source of the efficiency gain over doing them all now. In fact this might eventually provoke a clear-up of pointless accounts. In the context of doing that, changing passwords isn't such a big operation.

I think (although I am not sure) that if I very infrequently use a site then there's relatively little chance of my password on that site having being compromised due to heartbleed. Hence the preference for sites I actually use.

The main danger of that guess being wrong is if it turns out that heartbleed has been actively exploited for a long time. Then there is plenty of opportunity for masses of passwords to have been compromised either directly via heartbleed, or by the use of private keys or admin credentials from heartbleed.

[Edit: it's starting to look like maybe heartbleed has been exploited by the NSA for about as long as it has existed. Will have to wait for more information on that, but in any case I'm not as concerned by the NSA having my passwords as you might expect. If the NSA wants my passwords then it has them, heartbleed is one of only many means by which they might acquire them. If they've had them for two years then another month until I find time to change a bunch of low-value accounts won't make a difference.]

The main danger of delaying the password change is that somebody might already have my password, but either hasn't got around to pulling it out of the GB of data they obtained using heartbleed, or else hasn't got around to using it yet. Hence the preference for more sensitive systems.

6

It's questionable if this would actually take less work, but if you're at all handy with Javascript, you could write yourself some sort of mini-API that (once on the correct page) seeked out the correct fields and changed them for you:

https://stackoverflow.com/questions/257255/generic-way-to-fill-out-a-form-in-javascript

The upshot of this is once completed you'd have an easy go to for future changes. The downside is literally everything else about it.

5
  • And then any time any of those sites makes any kind of change to the page in question your script will likely break... :-(
    – Michael
    Apr 10, 2014 at 15:49
  • @Michael, not necessarily. Scripts like SuperGenPass do just that and are both very generic and very successful. It would actually be a useful companion tool once I start changing site passwords. It would be a dead-simple way to have long and unique passwords. Natch, most password managers have something like this but not as one-click easy. Apr 10, 2014 at 16:52
  • 1
    The downside seems pretty steep when you put it that way... Apr 10, 2014 at 16:59
  • @TorbenGundtofte-Bruun SuperGenPass appears to use a technique I did manually years ago before I had a keychain: I would take the web site name and run a secret transform in my head to create my password. This abruptly bit me when a site I bought stuff from got bought by a different site (thereby changing its name).
    – Michael
    Apr 10, 2014 at 17:12
  • @Michael I did the same thing, I stopped because I'd have a miniature stroke every time I'd have to reset my password and pick a new one. Anyway, to address what you said earlier: yes, super steep downside, and no, I wouldn't ever have this be the chosen answer; I felt that it was worth leaving here as an alternate solution for any of the braver super users who happened across the question. May 5, 2014 at 20:49
4

Check whether you can login with Google OpenID in some sites. That could reduce the number of passwords you need to change/manage/use.

Bookmark all 'Change password' pages and open them all in tabs together (or maybe in batches of 50). Make a script for generating a list of random passwords and copy-paste them with a copy-and-paste tool. Clean your system after doing this. Changing 50 passwords with this method won't take you more than 10 minutes, which seems a pretty reasonable time for a weekly maintenance.

Doing this, you'll change all your passwords once a month, investing 10 min. a week.

1
  • 1
    12 seconds per site sounds optimistic to me even opening every password-change page in tabs. But the principle seems right, this probably is the most efficient way to visit all the sites and change the passwords. Apr 10, 2014 at 18:36
4

Specifically for LastPass since you mentioned that, you could export a ccv file and submit the sites to one of the validation tools such as the one LastPass itself offers to determine which sites are even ready to have the passwords changed.

I'm sure each of the vendors is also busy creating/considering a tool to automate something equivalent (e.g., a supplement to LP's Security Challenge).

Each password manager is going to present a different challenge. For example Dashlane does not include the ability to sort passwords by date changed, although it does have a field you can re-purpose to checkoff passwords that have been changed or that you are going to ignore.

Update (Oct 2015) - LastPass and Dashlane (the two I've tried) and some other password managers now have a procedure/form that can make changing passwords at several hundred sites as simple as checking a box (if you trust the automation; they even know that some sites exclude/require certain special characters or mandate length). Alternatively, some take you directly to the site change page via a link, suggest a new password, and record your change.

If you like, open another browser and very quickly test the new password by using the 1 to 3 click open-and-autologin/autofill procedure for that website. Just be cognizant of how and when sync occurs.

I thought this deserved an update since we have had so many more large site cracks and network and router exploits.

1

If the systems let you connect via telnet or ssh or something similar, you could script the password changes in a relatively straightforward manner. If the password changes have to be done via a web interface, writing tooling to deal with the variations would probably be more work than it'd be worth but I'd at least try to make sure the new password was pasted in from a reliable source rather than hoping I could accurately retype it 400 times.

Federated ID systems simplify this somewhat by providing a single point to change the password for multiple systems... but of course you have to decide whether you trust those ID hubs.

NOTE: Changing passwords on a regular basis does NOT improve security as much as is commonly believed. If anything, it may encourage folks to pick inferior passwords, because picking a new good one every N months is a pain in the patootie. It only helps if you believe someone is reasonably likely to have stolen your existing password and if that password's getting out exposes something you care about or has a risk of being leveraged for rights amplification.

1

I do have a proposal which sounds feasible. I never try out myself though.

use AHK (key mouse event recorders ) you do a batch of password changes , and log the session using AHK. next time you want to change password. take out the AHK script and change the password only. you only need to play the AHK script again.

I myself use different pass for different sites, unless they are all leaked out, I don't need to change them at one time.

1

LastPass have heard you and posted a blog entry explaining how this can be done. And the bottom line is: you need to do it by hand site by site.

Also worth noting is that you should make sure the sites have been upgraded before changing your password.

0

You can try to use Dashlane utility which includes Password Changer feature (it's free) which can change dozens of passwords in a single click.

It does the heavy-lifting of replacing old passwords with strong new ones, and secures them in Dashlane where they’re remembered and typed for you.

1
  • As do many other password managers 3 or 5 years after the original post in 2014, including LastPass mentioned in the original post.
    – BillR
    May 31, 2019 at 22:48
-2

Create an Amazon Mechanical Turk.
Make a list of your web sites, user names, and current passwords. Each HIT will give out one or more of these. Give rules for what the new password must consist of. Paying $0.01 per password. The user must go change the password for you, and report back the new password. This should get your passwords changed pretty quick. https://requester.mturk.com/

3
  • 21
    Are you really sure it's a good idea to trust strangers working for MTurk to change your passwords ?
    – user256743
    Apr 10, 2014 at 7:24
  • 8
    I can only construe this as a joke, which should go in the comments session in worst case. Apr 10, 2014 at 13:53
  • 1
    LOL, why not skip the middle man and just send your PW manager DB straight to the Russian mob (or some other equally reputable group). On par with advice you'd expect to receive from a guy wearing a DOC jumpsuit.
    – krowe
    Apr 11, 2014 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .