So eBay sent out that email Wednesday telling everyone to change their passwords, and I sat there for about ten minutes trying to remember if I'd ever actually used my eBay password anywhere else. Turns out I had. Twice. One of those was for a forum I haven't logged into since 2012 and honestly forgot existed until I went digging.
That's the thing about password reuse, it never feels like a problem until a company you barely think about announces attackers were sitting inside their systems since late February, quietly copying out names, emails, birthdates, and encrypted passwords for something like 145 million accounts. eBay's been pretty vague about the actual mechanics of it, something about compromised employee credentials giving access to a database. Vague enough that I don't fully trust the "your financial info wasn't touched" line either, but that's a separate rant.
I'd been meaning to set up a proper password manager for probably two years at this point. Every few months I'd read some blog post about it, nod along, and then not do anything because typing a new password into a login box felt like more friction than it was worth at 11pm on a Tuesday. Funny how an actual breach with your own email address in the "notify these users" pile cuts through that laziness real fast.
I went with LastPass, mostly because a coworker uses it and wouldn't stop mentioning it, and because the free tier does everything I actually need. 1Password is nicer looking, I'll grant that, but it wanted me to pay upfront and I wasn't ready to commit money to something I hadn't tried yet.
Setting it up, roughly
Install the browser extension first, that's the whole ballgame with LastPass. It sits in your toolbar and once you log in with your one master password (pick a real one, a sentence works better than a word-plus-number combo, something like a line from a book you'd never forget), it starts offering to save credentials as you log into sites normally.
The part that actually took time wasn't installing anything, it was going through the accounts I actually cared about and changing the reused ones. I made a short list first instead of trying to do everything in one sitting, because that's the kind of project that dies if you try to boil the ocean. Email, eBay obviously, the one bank site that still makes you use a security question from 2009, and a couple of shopping accounts with saved cards. Everything else can wait and get swept up gradually as I log into things over the next few weeks.
LastPass has a password generator built into the extension, and I just let it spit out 16-character garbage for each site rather than trying to be clever. There's a temptation to make "memorable" passwords when you're doing this by hand, and that temptation is exactly the thing that got everyone into the reuse mess in the first place. If the manager remembers it, there's no reason for you to.
One annoyance: some sites, mostly older ones, cap password length at something absurd like 12 characters or reject certain symbols, so the generator's defaults don't always work first try. You'd think by 2014 that would be a solved problem. It is not.
I also turned on two-factor where it was offered, which for me ended up being Gmail and Dropbox. Google's version uses a code from an app on your phone, and it's a little annoying the first time you set it up on a new browser, but I'd rather deal with that than wake up to a "someone in Ukraine logged into your account" email.
None of this is complicated stuff. It's the kind of thing that takes maybe ninety minutes total if you sit down and actually do it instead of reading about doing it. My problem was never that I didn't know password managers existed, it's that nothing forced the issue until a company that I mostly associate with buying a used tripod in 2011 got hacked and put my inbox on a list.
If you've been putting this off the same way I was, consider this the nudge. You don't need eBay's permission to start.