Rotating passwords in bulk in the wake of security events May 11, 2017 on Drew DeVault's blog

I’ve been putting this post off for a while. Do you remember the CloudFlare security problem that happened a few months ago? This is the one that disclosed huge amounts of sensitive information for huge numbers websites. When this happened, your accounts on thousands of websites were potentially compromised.

Updating passwords for all of these services at once was a major source of frustration for users. Updating a single password can take 5 minutes, and changing dozens of them might take hours. I decided that I wanted to make this process easier.

$ ./pass-rotate github.com linode.com news.ycombinator.com twitter.com
Rotating github.com... 
  Enter your two factor (TOTP) code:
OK
Rotating linode.com... 
  Enter your two-factor (TOTP) code:
OK
Rotating news.ycombinator.com... OK
Rotating twitter.com... 
  Enter your SMS authorization code:
OK                                                                       

I just changed 4 passwords in about 20 seconds. This is pass-rotate, which is basically youtube-dl for rotating passwords. It integrates with your password manager to make it easy to change your password. pass-rotate is also provided in the form of a library that password managers can directly integrate with to provide first-class support for password rotation with a shared implementation of various websites. Not only can it help you rotate passwords after security events, but it can be used for periodic password rotation to keep your accounts safer in general.

How this was basically done is by reverse engineering the password change flow of each of the websites it supports. Each provider’s backend submits HTTP requests that simulates logging into the website and interacting with the password reset form. This is often quite simple, like github.py, but can sometimes be quite complex, like namecheap.py.

The current list of supported services is available here. There’s also an issue to discuss making a standardized mechanism for automated password rotation here. At the time of writing, the list of supported services is:

Adding new services is easy - check out the guide. I would be happy to merge your pull requests. Please add websites you use and websites you maintain!

I also set up a Patreon campaign today. If you’d like to contribute to my work, please visit the Patreon page. This supports all of my open source projects, but if you want to support pass-rotate in particular feel free to let me know when you make your contribution. This kind of project needs long term maintenance to support countless providers and keep up with changes to them. Feel free to let me know what service providers you want me to add support for when you make your pledge!

Have a comment on one of my posts? Start a discussion in my public inbox by sending an email to ~sircmpwn/public-inbox@lists.sr.ht [mailing list etiquette]

Articles from blogs I read Generated by openring

Status update, July 2021

Hi! This status update comes a bit late, because I was on leave, biking in the south of France for a few days. This month I’ve released mako 1.6, to try to make up for the long delay for the last release. mako 1.6 brings quality-of-life improvements: modes a…

via emersion July 21, 2021

The mythical 10× programmer is just a good leader

There is some truth to the idea that some programmers are more productive than others. In practice, this is mainly a function of the breadth and depth of their experience, rather than an expression of innate talent. Under the right circumstances, the differe…

via Blogs on Sourcehut July 17, 2021

Summary of changes for June

Hey everyone! This is the list of all the changes we've done to our projects and apps during the month of June. We'll also be reporting in our on position in the world, and on our future plans. Summary Of Changes Nasu, released a nasu guide, and…

via Hundred Rabbits July 1, 2021