Tresorit Password Problems

[WhitewaterWoman]

I have a cloud storage provider called Tresorit. It is totally encrypted end-to-end so that they do not even know your password.

I used it mostly for work and have not accessed it in years. But it does have documents in it that I don't want to lose.

Tresorit will give you a new password, but I would lose all the documents currently in Tresorit.

My memory is that I used a fairly common password in my password vocabulary because I knew I would have to remember it. I have tried to get into my account and none of the expected passwords have worked.

ChatGPT suggests that I check all my old devices because if I am still logged on to Tresorit on an old device, I can get in and change my pw. I have checked and even my old laptop does not have tresorit open. I don't have any system for saving passwords. I used to have Tresorit documents synched with my desktop, but they are no longer there. Or at least I can't find them.

The other options ChatGPT offers are not applicable or have not worked.

Tresorit will not give me my password or access to my account because they can't. Period.

So, my question, is there anyway to get this information back? Can my account be hacked in some way? By someone who knows what they are doing.

Thank you.

 

[JayLapointe]

What puzzles me is that why would a cloud storage service wipe your data if you reset the password? because that is what you are describing. Something doesn't make sense about that scenario at all.

But to answer you last question, any account of just about anyone can be hacked by someone determined enough. Doesn't mean that it will happen but passwords/2fa etc are like locks on a house. They only keep the really honest folks out. Working in IT it's more a question of slowing them down long enough to respond vs trying to think they can't find the cracks in the wall.

 

[Judge]

According to Tresorit, in the event you’ve forgotten your password and aren’t signed in on any device, the only option is to reset your account.

The bad news? Yes, you lose your data.

The good news? The process eliminates anyone else accessing such data.

I'd have to take them at their word in the event you are locked out of your own account. Yet in doing so all your files and account information will be erased in the process. Probably based on a "Hail Mary" security and liability precaution on their part.

Sadly I suspect the technical answer to your dilemma? -"SOL".

And if there was a workaround to circumvent such limitations, it's likely hackers would have gotten there first anyways. I've always taken the attitude that cloud-based anything is predicated first and foremost on user convenience. Not security.

Reset your account

 

[Judge]

What puzzles me is that why would a cloud storage service wipe your data if you reset the password? because that is what you are describing. Something doesn't make sense about that scenario at all.

That's because you are looking at it from a technical perspective, rather than one from the standpoint of legal liability. What some might call a "fail-safe" device. That access or data will not fall into the wrong hands in the event of a security failure.

A business trying to make their service as air-tight as is possible given the overt exposure of hackers to undermine security precautions that only go so far. Not so much to prevent worst case technical failures, but rather to limit damages in a civil court of law.

 

[JayLapointe]

That's because you are looking at it from a technical perspective, rather than one from the standpoint of legal liability. What some might call a "fail-safe" device. That access or data will not fall into the wrong hands in the event of a security failure.

A business trying to make their service as air-tight as is possible given the overt exposure of hackers to undermine security precautions that only go so far. Not so much to prevent worst case technical failures, but rather to limit damages in a civil court of law.

That makes sense. Thank you very much for that @Judge. It wasn't an angle that I'd thought of at all but once you said it, yeah I'll go put on my dunce cap. lol.

 

[velociraptor]

I'd have to take them at their word in the event you are locked out of your own account. Yet in doing so all your files and account information will be erased in the process. Probably based on a "Hail Mary" security and liability precaution on their part.

It means they take your security seriously, but they also expect you to take your own security seriously and have failsafes in place. Condolences @WhitewaterWoman.

 

[Judge]

That makes sense. Thank you very much for that @Judge. It wasn't an angle that I'd thought of at all but once you said it, yeah I'll go put on my dunce cap. lol.

It's something both myself and @velociraptor could go into greater detail given our backgrounds in insurance and in particular personal and commercial Electronic Data Processing (EDP) coverage.

That in as much as data can be insured, it still contractually requires a policyholder to have alternative security measures in place. Such as keeping copies of data/media off premises, but in a secure location such as in a bank's safe deposit box in a vault. Properly documented to underwriters to keep on record.

(Keeping such data off premises not under particularly secure circumstances is never recommended.)

 

[JayLapointe]

It's something both myself and @velociraptor could go into greater detail given our backgrounds in insurance and in particular personal and commercial Electronic Data Processing (EDP) coverage.

That in as much as data can be insured, it still contractually requires a policyholder to have alternative security measures in place. Such as keeping copies of data/media off premises, but in a secure location such as in a bank's safe deposit box in a vault. Properly documented to underwriters to keep on record.

(Keeping such data off premises not under particularly secure circumstances is never recommended.)

I know in the case of my municipality I work for, we keep copies of sensitive documents on site and we keep the originals in a separate location in an old bank vault in a building we inherited.

 

[WhitewaterWoman]

When I was working I did have a fail safe in place but somehow that is gone too. I had copies on my hard drive as well as in the cloud. When I retired some of my regular habits slipped away.

I was well-informed of the problem, so it I definitely my fault. I’m just trying to figure some way around it.

 

[Judge]

When I was working I did have a fail safe in place but somehow that is gone too. I had copies on my hard drive as well as in the cloud. When I retired some of my regular habits slipped away.

I was well-informed of the problem, so it I definitely my fault. I’m just trying to figure some way around it.

Best not to keep any important or sensitive data if possible on a hard drive- period. To keep them on redundant portable media that is periodically inspected to maintain data integrity. Often considered inconvenient, but then it's a minor aggravation compared to being hacked or more commonly when data is completely lost over a technical malfunction.

 

[Outdated]

So, my question, is there anyway to get this information back? Can my account be hacked in some way? By someone who knows what they are doing.

There's very few options unless you're in contact with a dedicated hacker that knows what they're doing, and even then it might not work.

I had a thought about your mention of trying different passwords though, this is known as a "brute force attack" and is something that will automatically lock an account on some sites for a few hours. If you go back in later on try again but only try twice with two different passwords. If that fails try again more than an hour later, once again only try two of your passwords, trying and failing a third time is when accounts usually get locked.

 

[Alexej]

When I was working I did have a fail safe in place but somehow that is gone too. I had copies on my hard drive as well as in the cloud. When I retired some of my regular habits slipped away.

I was well-informed of the problem, so it I definitely my fault. I’m just trying to figure some way around it.

If you have some of your old hard drives try doing a search on them for tresorit - you might find it there.