Hacker News Reader

Comment by pmontra | Hacker News Reader

I have hundreds of passwords in my password manager. That's going to take a week, considering I also have to work.

Is your password manager 1Password?

https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...

Even if your password manager is not compromised, the credentials of so many sites is potentially leaked that you should probably still update a substantial number of passwords.

I hope 1Password's Watchtower service will soon give hints.

Disclaimer: I work for AgileBits, makers of 1Password.

I am combing through site lists trying to find sites that are impacted. However, I am only updating based on sites that have suggested that they be updated. Very few are suggesting password updates right now. But, there are a few that are in Watchtower now.

Lists like the one this link to are useful, but they don't actually say if a site was indeed impacted. In the end we may just treat this like Heartbleed and suggest they all get updated but for now, we're trying to only suggest it where necessary.

If you're aware of any that have suggested password changes please let me know and I'll get them added immediately :)

Kyle

AgileBits

Even if it is, what does it have do to with all those hundreds of sites?

No, it's keepassx on my laptop. I don't trust my passwords to somebody else.

So why do you have to change them all?

My cleartext passwords could have been dumped into the responses of some other site together with my user names. That's the gist of this incident.

I still don't understand why you have to change every password (are not they supposed to be all different in a password manager?). Of course if you are super extra mega careful then change them all...

pmontra doesn't have to change every password, just every password used by a website using Cloudflare (thus the purpose of the list of affected sites).

You might find this script I wrote to be helpful:

https://github.com/nandhp/misc-utils/blob/master/keepassx_do...

Same here. I just spent the last 30 minutes changing passwords at my most critical sites. Banking, email, VPS providers, etc.

I figure I’ll slowly work through the rest in the coming weeks as time allows.

Same here... And this made me realize how painful it can be to change password on some website.

Reply on news.ycombinator.com