Find Old Accounts (Part 1)

[This is Part 2 of a multi-part series. Start here.]

As we discussed in the introductory post, you likely have dozens if not hundreds of online accounts – many of which you may have forgotten about. We want to make a definitive list of all your online accounts so we can make sure they’re secure. And if you no longer need them, we’ll either disable them or delete them altogether.

To make an exhaustive list of all of your accounts, we’re going to put on our detective hats and look for clues. Examine the forensic evidence of our digital lives. We want to find accounts that we made years, maybe even decades ago. Did you have an AOL (America On Line) account? MySpace? Ebay? Did you have email accounts from your internet service provider (ISP) like Prodigy or Earthlink? Almost surely – we all did in the early days. Now… how many of those accounts are still open? Let’s see what we can dig up.

I’m going to give you multiple methods for finding old online accounts. We’ll start with the easiest and most productive techniques, but I’ll also give you some options for really scraping the bottom of the barrel, too. These research methods will span multiple articles because I want to break the effort up into manageable chunks.

Getting Organized

There already exists a fantastic tool for automagically recording all your online accounts: a password manager. By virtue of its purpose of retaining all the user ID’s and passwords, it is naturally a catalog of all of your accounts. As we find old accounts that even our password manager doesn’t know about, those accounts will be automatically added when we recover them. (Most password managers will prompt you to save login credentials for sites it hasn’t already saved.)

Furthermore, the first thing we’re going to want to do with any old account is to change the old password to something long, strong and unique. This will be true even if you think the old password was decent (it’s probably not). You don’t really have to rotate your passwords frequently, but if you haven’t used the account in many years, it would be smart to update the password (especially if you may have used that same password on any other account, ever).

There’s really no better tool for this. And at this point, we should all be using a secure, dedicated password manager. If you still haven’t bought into the whole password manager thing, now is the time. Seriously, this is it.

Migrating to a Password Manager

This topic honestly deserves a dedicated article and I plan to do that at some point. (Note that I do cover all of this in my book.) But let’s talk briefly about setting up a password manager and populating it with all your account credentials.

For the vast majority of people, I recommend using a cloud-synced password manager with plugins for your web browsers and apps for your phones. It’s very secure and very convenient. I personally use and recommend BitWarden. It’s rock solid, supported on every platform, and very reasonably priced – there’s even a usable free version. However, Proton Pass and 1Password are also good. Apple’s new(ish) Passwords app is fine, too, but not as well supported on non-Apple platforms.

If you’ve been using your web browser to store and auto-fill your user ID’s (often your email address) and your passwords, you should migrate to a reputable, dedicated password manager and use their browser plugin. Browser-based password auto-fill mechanisms aren’t as secure as they need to be and they’re only usable in that browser. You can and should move your passwords from your browser’s auto-fill into a real password manager. Here’s how to do that with BitWarden.

If you just cannot bring yourself to set up and use a password manager, then I would use a paper notebook to record the accounts and new passwords – something you can close and store out of sight. Do NOT use a computer file if you’re going to save passwords in that file (unless you know how to properly encrypt the file) – it just exposes you to too much risk. See below for more on this.

Method 1: Saved Passwords

Online accounts, by their very nature, come with credentials. For the vast majority of us, that means passwords. (Let’s set aside passkeys for now.) So the first and simplest method for creating a list of your accounts is to look at your list of saved passwords, however you saved them.

If you’re already using a password manager, then you’re in great shape! You’ve already got a list of all your online accounts – at least ones you’ve accessed since you started using the password manager. And as you go through this process and access other accounts not yet stored there, your password manager will helpfully offer to save them – expanding your definitive list of accounts and consolidating that list into a single, secure, and convenient location. It’s another great reason for using a password manager.

But there are other places we save passwords. Many of us still have a notebook or sticky notes or maybe even a spreadsheet with a list of accounts and passwords. Find them and move the info to your password manager. You want a single source of truth for this info. And you want it to be very, very secure.

Even if you don’t remember using your web browser to store web passwords, you should verify this. You’re going to want to check for saved passwords or “form fills” in every browser you’ve ever used. And you’ll want to do this search on every device you still have access to. Did you log in using a spouse’s or child’s computer? Here are some articles on how to find and delete passwords stored in your browser: Chrome, Safari, Firefox, Internet Explorer, Edge. (Or try this article, which covers many browsers.)

Insecure Password Storage

A couple quick caveats. First, note that passwords on many browsers will sync to the cloud, if you were signed into the browser with an account. This would be most likely for Google’s Chrome browser since many of us have several other types of Google accounts, all with the same credentials (if you log into one, you’re more likely to be logged into them all). And browsers can sync passwords through the cloud, meaning that there may be insecure copies of these credentials stored there. Deleting them from your browser while logged in to the associated browser “cloud” or “sync” account should remove them everywhere.

Second, if you’ve ever stored passwords in any sort of digital file on your computer or in an app on your smartphone that was not specifically designed for storing passwords or text securely, I would assume those passwords are at risk of compromise. While it’s possible that files or data could be extracted by malware, I’m more concerned that the data was synced to the cloud without you being aware – and that the data wasn’t properly secured. Google Drive, Apple iCloud and Microsoft OneDrive would be prime suspects, but if there’s any cross-device syncing or cloud backup going on, however it’s done, it may not be secure. You should attempt to find and securely delete this data after you transfer the information to your password manager.

I would put a star by any at-risk passwords and change them to something else when you can.

Next Steps

In the next installment in this series, we’ll cover several techniques for unearthing old accounts that aren’t quite as easy or obvious.