So Evernote had a bad week. A few days ago they sent out that email, the one that says "we detected suspicious activity on our network" and then, three paragraphs later, asks you to reset your password for basically no reason at all, wink wink. Except this time there was an actual reason. Somebody got into their systems and grabbed usernames, email addresses, and the encrypted/salted passwords for every single one of their roughly 50 million users. Fifty million. Evernote says the notes themselves werent touched and no payment info was exposed, and I believe them, mostly, because that stuff lives on separate systems. But still. Fifty million.
I use Evernote for basically everything. Blog drafts, half-formed post ideas I type into my phone at 1am and never look at again, screenshots of receipts I need for taxes, a running list of things my nephew says that are too good to lose. Its become the drawer I dump my brain into. So getting that email Saturday morning while I was still in bed, phone six inches from my face, was not a great way to start the day.
Heres the part thats actually on me though. I went to change my Evernote password and realized it was the same password I use for about six other things, one of which is a forum I havent logged into since 2009 and one of which is, I am not proud to say, my Amazon account. I know. I KNOW. Ive read a hundred blog posts (some of them probably written by me, actually, thats embarrassing) about password reuse being the single dumbest thing you can do with your online life, and I did it anyway, because remembering nine different strong passwords is annoying and I am, apparently, lazy in exactly the way that gets you burned.
So I spent about ninety minutes Saturday afternoon actually going through and changing passwords on the accounts that mattered most. Not all of them — Im not a saint, and some 2007-era forum login isnt worth the fifteen seconds it'd take to fix. But the important ones. Email, banking, Evernote obviously, the Twitter account I actually use. I keep meaning to just set up LastPass properly and be done with this whole problem forever, and I keep not doing it because the browser extension always seems to break on whatever machine Im using that week. Someday. Maybe this is the week that finally pushes me over.
What bugs me isnt really that Evernote got hit. Everybody gets hit eventually, thats just where we are now — you put enough data in enough places and sooner or later one of those places has a bad night. What bugs me is how predictable my own reaction was. I wasnt careful because nothing bad had happened yet. Thats such a dumb way to run your digital life and I do it anyway, and I bet most people reading this do too, so I dont feel that bad admitting it in public.
In slightly happier tech news, SXSW kicks off today down in Austin, which means my Twitter feed is about to fill up with pictures of tacos and lanyards for the next five days straight, and I am, as always, watching from a comfortable distance up here rather than dealing with the crowds. Somebody I follow is already tweeting about the line for badge pickup being absurd, which, yeah, sounds about right for a Friday morning in March.
Anyway. Go change a password today. Not all of them. Just the one you know is bad, the one youve been meaning to fix for months, the one youre thinking about right now while you read this. You know which one it is. Ill wait.