Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a lot of online accounts, web services, and so on -- personal as well as business -- so obviously(?) I use a password manager to handle them all. Specifically I use Lastpass but my question applies to any and all:

Given the Heartbleed problem and related questions, even if I wanted to change all my passwords (and shouldn't we all be doing that at regular intervals??), how in the world can I change so many passwords in an efficient manner?

If I have to visit each service and site individually and change the PW manually, it's clear that it will take a weekend of dedicated work ... password security is good and all but that's just not practical.

Update: I just used Lastpass's "security challenge" which reports that I have 274 sites and a security score over 83%. Several intranet sites at work reuse the same pw which significantly lowers my score. All my Internet accounts score above 92%.

share|improve this question
6  
Please read this fine literature before changing all your passwords: security.stackexchange.com/questions/55283/… –  MonkeyZeus Apr 9 at 19:43
4  
I'm glad you enjoyed my humor :) but in all seriousness there is no easy way out. And I think you may have missed the main point of my link which is this section: Changing passwords on a site that is/was vulnerable to Heartbleed is only effective after –  MonkeyZeus Apr 9 at 20:08
    
Referencing this question on Information Security: API to change passwords? –  unor Apr 11 at 18:07
1  
good thing that we're now moving on to OpenID/OpenAuth based signon. All you need is just change the password for the identity provider and the rest is on the individual websites. Also, do note that it's only worth it to change password for sites that have already updated their OpenSSL library; probably a good number of those 200 websites you have never makes any updates on their system even in the face of Heartbleed. –  Lie Ryan Apr 12 at 20:52
2  
Congratulations on being the one user that actually uses different passwords for each different service. –  JFA Apr 14 at 0:22

11 Answers 11

up vote 60 down vote accepted

Honestly, there is none. Not unless they offer an API where you can do remote management on your accounts. Pick and choose. Which ones are the highest priority. Bank for example you should change. Forums and other media sites could be ranked lower and changed on a need basis.

PS: I also think people are blowing this heartbleed way out of proportion.

share|improve this answer
1  
Comments have been purged. Super User is not a discussion forum—comments should be used to ask for clarification (which should later be addressed in the answer) or point out issues in a post. If you want to talk about Heartbleed, Super User Chat would be the best place. Thanks. –  slhck Apr 12 at 11:31
    
^ @slhck I suggest they discuss it in a special room for IT Security or suchlike, to avoid overwhelming the regular room. Can you post a link to suitable room? –  smci Apr 12 at 23:23
    
@smci I believe that our main room is actually well suited for that kind of discussion. We usually don't enforce any topics. Information Security also have a chat room. –  slhck Apr 13 at 8:09

I'm curious what kind of answer you expect to get... A piece of software that cascades password changes over various protocols, sites, procedures, etc.? I'll bite my tongue on my opinion of the cost/benefit of actually changing all those passwords, considering any one of them could be cracked in a reasonable time frame, regardless if they are compromised. Instead, I'll recommend you gather contact information for each of these sites and services. Then send an e-mail to all of them requesting your password reset or to re-establish a new password on next login. I don't see any other shortcuts here.

share|improve this answer
8  
A lot of websites likely will send a reply back stating "If you wish to reset your password, please click on the following link: password reset link". –  Nate Kerkhofs Apr 10 at 8:45

Since your question probably doesn't lend itself to an easy answer, I would propose that you change the passwords of websites based on how vulnerable they make you (loss of money, loss of privacy, loss of reputation, etc.)

share|improve this answer

I will probably:

  • review the list for sites storing truly sensitive information
  • change those as soon as it seems clear the site is ready for that
  • change the remainder the next time I use the site or if the site requests/forces a change.

This means some of them will never be changed, because I will never use the site again, and that's the source of the efficiency gain over doing them all now. In fact this might eventually provoke a clear-up of pointless accounts. In the context of doing that, changing passwords isn't such a big operation.

I think (although I am not sure) that if I very infrequently use a site then there's relatively little chance of my password on that site having being compromised due to heartbleed. Hence the preference for sites I actually use.

The main danger of that guess being wrong is if it turns out that heartbleed has been actively exploited for a long time. Then there is plenty of opportunity for masses of passwords to have been compromised either directly via heartbleed, or by the use of private keys or admin credentials from heartbleed.

[Edit: it's starting to look like maybe heartbleed has been exploited by the NSA for about as long as it has existed. Will have to wait for more information on that, but in any case I'm not as concerned by the NSA having my passwords as you might expect. If the NSA wants my passwords then it has them, heartbleed is one of only many means by which they might acquire them. If they've had them for two years then another month until I find time to change a bunch of low-value accounts won't make a difference.]

The main danger of delaying the password change is that somebody might already have my password, but either hasn't got around to pulling it out of the GB of data they obtained using heartbleed, or else hasn't got around to using it yet. Hence the preference for more sensitive systems.

share|improve this answer

It's questionable if this would actually take less work, but if you're at all handy with Javascript, you could write yourself some sort of mini-API that (once on the correct page) seeked out the correct fields and changed them for you:

http://stackoverflow.com/questions/257255/generic-way-to-fill-out-a-form-in-javascript

The upshot of this is once completed you'd have an easy go to for future changes. The downside is literally everything else about it.

share|improve this answer
    
And then any time any of those sites makes any kind of change to the page in question your script will likely break... :-( –  Michael Apr 10 at 15:49
    
@Michael, not necessarily. Scripts like SuperGenPass do just that and are both very generic and very successful. It would actually be a useful companion tool once I start changing site passwords. It would be a dead-simple way to have long and unique passwords. Natch, most password managers have something like this but not as one-click easy. –  Torben Gundtofte-Bruun Apr 10 at 16:52
    
The downside seems pretty steep when you put it that way... –  Raystafarian Apr 10 at 16:59
    
@TorbenGundtofte-Bruun SuperGenPass appears to use a technique I did manually years ago before I had a keychain: I would take the web site name and run a secret transform in my head to create my password. This abruptly bit me when a site I bought stuff from got bought by a different site (thereby changing its name). –  Michael Apr 10 at 17:12
    
@Michael I did the same thing, I stopped because I'd have a miniature stroke every time I'd have to reset my password and pick a new one. Anyway, to address what you said earlier: yes, super steep downside, and no, I wouldn't ever have this be the chosen answer; I felt that it was worth leaving here as an alternate solution for any of the braver super users who happened across the question. –  Sandy Gifford May 5 at 20:49

Check whether you can login with Google OpenID in some sites. That could reduce the number of passwords you need to change/manage/use.

Bookmark all 'Change password' pages and open them all in tabs together (or maybe in batches of 50). Make a script for generating a list of random passwords and copy-paste them with a copy-and-paste tool. Clean your system after doing this. Changing 50 passwords with this method won't take you more than 10 minutes, which seems a pretty reasonable time for a weekly maintenance.

Doing this, you'll change all your passwords once a month, investing 10 min. a week.

share|improve this answer
1  
12 seconds per site sounds optimistic to me even opening every password-change page in tabs. But the principle seems right, this probably is the most efficient way to visit all the sites and change the passwords. –  Steve Jessop Apr 10 at 18:36

Specifically for LastPass since you mentioned that, you could export a ccv file and submit the sites to one of the validation tools such as the one LastPass itself offers to determine which sites are even ready to have the passwords changed.

I'm sure each of the vendors is also busy creating/considering a tool to automate something equivalent (e.g., a supplement to LP's Security Challenge).

Each password manager is going to present a different challenge. For example Dashlane does not include the ability to sort passwords by date changed, although it does have a field you can re-purpose to checkoff passwords that have been changed or that you are going to ignore.

share|improve this answer

If the systems let you connect via telnet or ssh or something similar, you could script the password changes in a relatively straightforward manner. If the password changes have to be done via a web interface, writing tooling to deal with the variations would probably be more work than it'd be worth but I'd at least try to make sure the new password was pasted in from a reliable source rather than hoping I could accurately retype it 400 times.

Federated ID systems simplify this somewhat by providing a single point to change the password for multiple systems... but of course you have to decide whether you trust those ID hubs.

NOTE: Changing passwords on a regular basis does NOT improve security as much as is commonly believed. If anything, it may encourage folks to pick inferior passwords, because picking a new good one every N months is a pain in the patootie. It only helps if you believe someone is reasonably likely to have stolen your existing password and if that password's getting out exposes something you care about or has a risk of being leveraged for rights amplification.

share|improve this answer

I do have a proposal which sounds feasible. I never try out myself though.

use AHK (key mouse event recorders ) you do a batch of password changes , and log the session using AHK. next time you want to change password. take out the AHK script and change the password only. you only need to play the AHK script again.

I myself use different pass for different sites, unless they are all leaked out, I don't need to change them at one time.

share|improve this answer

LastPass have heard you and posted a blog entry explaining how this can be done. And the bottom line is: you need to do it by hand site by site.

Also worth noting is that you should make sure the sites have been upgraded before changing your password.

share|improve this answer

Create an Amazon Mechanical Turk.
Make a list of your web sites, user names, and current passwords. Each HIT will give out one or more of these. Give rules for what the new password must consist of. Paying $0.01 per password. The user must go change the password for you, and report back the new password. This should get your passwords changed pretty quick. https://requester.mturk.com/

share|improve this answer
20  
Are you really sure it's a good idea to trust strangers working for MTurk to change your passwords ? –  André Daniel Apr 10 at 7:24
7  
I can only construe this as a joke, which should go in the comments session in worst case. –  Quora Feans Apr 10 at 13:53
1  
LOL, why not skip the middle man and just send your PW manager DB straight to the Russian mob (or some other equally reputable group). On par with advice you'd expect to receive from a guy wearing a DOC jumpsuit. –  krowe Apr 11 at 16:42

protected by slhck Apr 12 at 11:26

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.