Mrthfx

This is a known problem without an existing solution. Some password management tools are working on it, but it is not complete or fool-proof.

For example: https://helpdesk.lastpass.com/generating-a-password/

Auto-Password Change will change a site’s password with a
single-click. This feature currently supports 75 of the most popular
websites. You can see the full list of supported websites below.

In general, though, when you use a password manager for all your accounts, 90% of the work you need to do is already done. You know which sites use that username/email, and you can avoid re-using passwords in the first place (or know which accounts use a shared password).

One tip to help you out on your journey is that multiple sites have recently implemented the "well-known password change URL". This is something you can plug in to any (supporting) website that redirects to the page that lets you change your password.

Take the homepage of the site, and add /.well-known/change-password to the end. Examples:

accounts.google.com/.well-known/change-password

  -> https://myaccount.google.com/signinoptions/password



github.com/.well-known/change-password

  -> https://github.com/settings/admin



twitter.com/.well-known/change-password

  -> https://twitter.com/settings/password



meta.discourse.org/.well-known/change-password

  -> https://meta.discourse.org/my/preferences/account

One alternative solution to identify sites that you used your email address on is to look into your browser's saved passwords.

This will allow you to see every site you have saved passwords for in your browser which might help you identify ones that need to be changed.

Obviously, this only works if you use the browser's "save password" feature.

It's a hard problem because the top list of websites is so personal... And what you have to lose is in no way proportional to the site's popularity on any index of popular sites.

And only you know where you might have accounts.

For instance, I consider gaming sites to be more critical than banking sites. Because there are much fewer controls and less legal peril involved in hacking MMO gaming accounts, so they are the darlings of crackers. On the other hand, if you're done with Maplestory, you may not care.

But you certainly don't need to care about your Eve Online account if you definitely never played it. Only you know this sort of thing.

If you think you might have used a site in the past, why not just try your old credential?

Why not just spam every website with password reset requests?

They're not going to cooperate with large scale automated requests of this type.

First, the website acknowledging whether an email has an account, would empower spear phishing. Scammer gets a billion emails (easy enough), they start banging the website's password reset to learn "does this email have an account here, or not?" Now they have a list of 1 million emails that do. Now they start spear-phishing those known account holders. Put them on a daily newsletter where unsubscribe requires a login, that kind of thing. This is a "many email addresses against a single site" attack. The site's best defense is to add friction to the password reset process, e.g. a CAPTCHA, or simply design the password-reset process so it tells the inquirer nothing about whether an account exists. This is even more important for sites like Ashley Madison or Furries where having an account there could be embarrassing.

Second, if a cracker managed to gain control of an email, they could simply do exactly what you're trying to do - ascertain which websites this email has an account on. With a full dossier, they can then attack those sites or simply sell the credentials for more than they could otherwise. This is a "single email vs many sites" attack. In this case, the site needs to control one-off access to the password reset function - something like a CAPTCHA is called for. And 2-factor authentication - but again, this 2FA must not disclose to the casual inquirer whether an account here exists.

Because of this, I don't see a probability of anyone writing an app to do this. The writer would find herself in a hacking "arms race" with many companies trying to stop her automation from working.

You can absolutely reset passwords automatically if your password manager supports it (I use LastPass) -- even retroactively. You don't have to have created the site using LastPass in order for it to be able to reset your passwords for you. You simply have to load the credentials into it and ask it to perform the password reset function.

In LastPass, simply allow LastPass to remember your credentials for the site (typically by logging in), and then on the Edit Site window of your vault, simply select Auto Change Password below the password field.