Securing Old Accounts

[This is a multi-part series. Start here.]

In the previous parts of this series, we’ve explained why finding old accounts is so important and then helped you build an exhaustive list of all your online accounts, including long-forgotten ones. Now it’s time to make sure those accounts are secure and take stock of the data still held there – and perhaps even download a copy for backup.

Securing Your Old Accounts

We’ve done the hard part. Enumerating and (if necessary) regaining access to all our old online accounts can be time consuming. But now that we have them all documented (hopefully by adding all the accounts and credentials to a password manager), we should take the time to secure them. Our passwords on really old accounts were probably weak and perhaps even shared across multiple accounts.

First, we should change the passwords to be long, strong and unique. Again, the best way to do this is with a password manager. However, if you’re bound and determined to write them down, you should still use a random password generator to create the new passwords. You can use an online tool like these from Bitwarden or 1Password. I recommend using at least 15 characters, but if you’re saving them in a password manager, you should use at least 20 if the site allows it.

Second, check your recovery options for your account (probably in the Account or Security Settings or Profile). Some will have recovery codes – be sure you note them down and any special URL/link you need to use them. Others will have “security questions”. You should consider changing your answers to these. Note that you don’t have to tell the truth! You just have to remember your lies. I recommend this – otherwise someone who can figure out the answers can seize control of your account. Finally, check the recovery email address associated with the account and update this to something you’re likely to have control over for the foreseeable future.

Finally, if the account offers two-factor (or multi-factor) authentication, I would add this layer of protection – it makes your account much more secure. If don’t have an “authenticator app”, try Ente Auth, Proton Auth or Authy. And be sure to back up your 2FA seed codes.

Backing Up Old Data

While you’re in these old accounts, poke around and see what sorts of data is still there. This includes not just the publicly visible data – if you have unpublished articles, images, or data only shared with ‘friends’, then this data could still be compromised, leaked, shared with third parties, or used to train AI models.

You might want to update your contact information (particular for account recovery). On the other hand, if you think you’re going to abandon or close this account, you might want to populate it with bogus information. You can request to close old accounts, but you’ll never know for sure if they did it properly, including all backups of your data.

You should consider making a copy or backup of the data associated with your accounts. Thanks to privacy laws in various parts of the world, most online accounts now offer a formal way to request a copy of all your data. You may have to dig around in your profile or account, perhaps under the privacy settings. If that fails, do a web search for the site name plus “download your data” or “request copy of your data” to find instructions. These types of requests can take time (hours to days) – in which case you will likely get an email with a download link when it’s ready.

Alternatively, you could just manually save the images, projects, texts, or whatever that you care about. Either way, you might want to set up a dedicated ‘backup’ folder somewhere to hold this data (that is itself backed up). And if the sites gives you a big zip file of your data, be sure to open it up (usually just double-click it) and make sure the contained files are in a format you can use.

Final Steps

We’re almost done! There’s just one more article left in this series. In that final article we’ll decide whether we want to strip a site’s data down to the minimum, populate it with bogus info, or just delete it altogether. I’ll give you tips and tricks for how to do this and also how to follow up to make sure your wishes were honored.