Why is my password manager telling me I have a password at risk?
Hi, everyone. Leo Notenboom here for askleo.com.
Here's the question.
My password vault recently started telling
me that I have 600 hundred passwords at risk.
What does that mean?
Do I have to change 600 passwords?
It's a security feature that's been added
to a lot of the password vaults, including the one that I use LastPass.
LastPass is basically taking a look at the passwords you have and telling you
that there might be some issues with the ones you happen to have chosen.
Exactly what those issues are could be any of several different things,
and I want to walk through exactly what those options are.
The one we think of right away is that your password was discovered in a breach.
Password managers will securely, never exposing your password, check to see if
that password happened to be in a password breach.
A discovered password breach.
In the past, the services used by Have I
Been Pwned, for example, can do this for you manually. Pwned passwords.
But this automates the process and actually checks all of your passwords
to see if they were discovered in a breach.
If they were, they're at risk.
Even if they weren't discovered at the services, you happen to use them.
Here's why.
When hackers discover passwords that have
been used anywhere, they will then try those passwords everywhere.
So as soon as a password is discovered,
it should no longer be considered a good password.
Its security is at risk.
The second thing that we think of, you're reusing passwords.
Literally, if the password manager sees you use the same password for two
different sites, it's going to say those are at risk.
Because password reuse is in fact one
of the most common ways that accounts are being hacked these days.
You definitely want to make sure you're using a unique password at every site.
Password managers make this easy to do.
You don't have to remember any of them,
which is usually the reason people are reusing passwords.
So make sure you're using a different password at every site.
There is a false positive scenario based on your password manager noticing
that you've got the same password in two different entries.
Sometimes the password manager makes two different entries.
By that I mean it may have a URL for a site, say,
Outlook.com and a password, and it may have another URL for that same
site, because when you go to Outlook.com, it goes to something or other live.com,
and every once in a while that changes, which means you'll have saved the same
password for the same site, but in two different vault entries.
So that's something to at least be aware of.
Now, the question, of course, is, I think you have to change all 600.
The ideal answer, of course, is, well, yeah, you should, because they're at risk.
Except for, of course, those ones that are false positives.
But it does mean checking all
of the entries and making sure that they're not false positives,
which means you have to walk through all 600 in practice.
No, I've got multiple entries in my LastPass
database that actually tell me my password is at risk.
I haven't acted on many of them, actually, for a variety of reasons.
What I do suggest you do is do the work but prioritize it.
In other words, change anything that you consider to be important right away.
If it's your bank password that's at risk
and it's not a false positive, change your bank password, that kind of thing.
Make sure that the important accounts are covered first.
Then, as time permits,
change the password for any sites where you've been reusing passwords.
Then, as time permits, change passwords that have been reported in a breach.
Then, as time permits, change whatever's left.
Or just clean up the duplicate entries or whatever makes sense to you now.
I keep saying as time permits.
Honestly, it could be a really long time.
It could be months, it could be years.
That's okay, as long as you're doing it
in a priority order, making sure the important accounts are handled first.
And as a side note, make sure that when you create a password
for account be a change password for an existing account or a new account
that you're creating, make sure that it doesn't immediately show up as at risk.
That's your opportunity to make sure that it's as secure as it can possibly be.
Hopefully, that helps explain the situation.
Hopefully that gives you some sense of direction of what to do with it.
For updates, for comments, for related links, and more visit
askleo.com/147090. I'm Leo Notenboom, and this is Ask Leo.com. Thanks for watching.