mSecure password manager ordered resets after a breach without explaining what happened: switch managers now, or wait for details?
I use mSecure as my password manager and just got told to reset my password after some kind of breach, with no real explanation of what was exposed. That is not a great feeling when the whole point of the app is to hold your secrets. I am weighing whether to export my vault and move to another manager now, or wait for them to publish details. For people who have been through a password manager breach before: what did you do first, and what would you check before trusting the app again?
1 answer
- Export your vault and move, do not wait
When a password manager has a breach and will not say what was exposed, assume the worst and move. Export your vault now while you still can, import it into a manager with public third-party audits, then rotate your email and banking passwords first since those unlock everything else. Turn on two-factor authentication on the new manager before you finish the move. Waiting for a detailed postmortem leaves your vault sitting in an account you already have reason to distrust.