So I woke up Sunday morning to an email from Evernote telling me my password had been reset, and my first reaction, before coffee, before anything, was pure annoyance. Turns out Evernote had a breach attempt over the weekend, they noticed unusual access on their network, and by Saturday they were resetting passwords for basically their entire user base, something like 50 million accounts. Their post says the intruders got in far enough to see usernames, email addresses, and password hashes, but they're saying no note content got touched and no payment info was exposed. I believe them, mostly, because Evernote's whole business depends on people trusting them with years of notes, and torching that trust over nothing would be insane.
Still. Fifty million accounts is not a small number and this is not a small company. I've had an Evernote account since like 2011, back when I first started this blog actually, and I've got something like 4,000 notes in there at this point, half of them are draft posts for this exact site, receipts I never look at again, and a truly embarrassing quantity of half-finished packing lists. So when the reset email showed up I wasn't scared exactly, more just annoyed that Sunday morning now involved a password.
Then I went to actually change it and had a much worse moment, because I realized the password I'd been using for Evernote was one I use in like three other places too. I'm not proud of this. I've read every "use a password manager" post that's ever been written, including probably one of my own from a year or two back, and I still did the thing where you pick a decent password once and then reuse it because typing a new random string into your phone at 2am is annoying. Anyway. I spent about forty minutes Sunday going through and changing that password everywhere I could remember using it, which is exactly the kind of chore nobody wants but everybody deserves after doing this to themselves for two years straight.
What actually struck me reading Evernote's writeup is how calm and specific it was. No hand-wringing, no vague "your security is our top priority" corporate mush — they said what happened, said what wasn't touched as far as they know, and pushed the reset immediately rather than sitting on it. Compare that to how some companies handle this stuff, sending out some watered-down statement three weeks after the fact once a reporter starts asking questions. Evernote's timeline here was fast: notice something's wrong, lock it down, tell everyone right away, even on a weekend when nobody wants to be doing incident response. I'll give them credit for that even while I'm irritated about the whole thing.
The other piece of this that's stuck with me is Evernote saying they're planning to roll out two-step verification because of this. Good. It's overdue honestly, for an app that's basically a second brain for a lot of people, storing meeting notes and half-written novels and, for me, a truly cursed number of blog drafts, having only a password between the internet and all of that always felt a little thin. I use two-factor on my Google account already and it's not even that annoying once you get a code generator app going. If Evernote actually ships this instead of it becoming one of those forever-promised features, I'll take it as a small silver lining out of an otherwise mildly stressful Sunday.
None of this is the biggest tech story going around this week, I know — there's a lot of noise about phones and Mobile World Congress recaps still floating around from the tail end of February, and SXSW starts up down in Austin in a couple days which will eat everyone's attention for a while. But the Evernote thing is the one that actually touched my life directly, made me change passwords on three sites before lunch, and reminded me that I really do need to just install a password manager instead of pretending I'll get around to it. Maybe this is the week. Probably not, if I'm honest with myself, but maybe.