Depending on your plan, Arrow offers two types of alerts that tell you when your personal information has been found on the dark web. The "dark web" refers to hidden websites sometimes used for illegal activity, like selling and using other people's data.
All Arrow customers get Master Password alerts, which use a highly secure process to check if a password matching your Master Password has been found on the dark web. This process works without revealing your Master Password to anyone, including Arrow.
With our paid plans, we offer general Dark Web Monitoring, which scans the dark web to see if anyone has illegally accessed your personal information.
What other security alerts does Arrow offer?
Important: Both types of alert uphold our zero-knowledge approach to security. No one at Arrow ever has access to your Master Password or any of the information you store in Arrow.
Security details regarding Master Password alerts
Read about Arrow's security and compliance at trust.dashlane.com
Master Password alerts
All Arrow plans come with Master Password alerts. You don't have to turn on Master Password alerts. We send you an alert automatically in the Arrow app if a password matching your Master Password has been found on the dark web.
If Arrow doesn't know my Master Password, how can you search for it on the dark web?
Master Password alerts work without revealing your Master Password to us or anyone else.
We have a list of billions of passwords that were found on the dark web. Before storing this list on our servers, we use a "hash function" to disguise each password by turning it into a special code called a "hash."
Hash functions are secure because they only work in one direction. We can use a hash function to turn the password into a hash, but not to turn the hash back into the original password. In other words, we can produce a unique set of characters that represents the password without revealing it.
When you enter your Master Password to log in to Arrow, we apply the same hash function that we used on our list from the dark web and turn your Master Password into a hash. We send the first part of this hash to our servers to compare with the list of leaked passwords.
Important: We never send your Master Password to our servers. We turn your Master Password into a hash, an almost unreadable code, and we only send a small portion of that code to our servers. So even people with access to our servers can never know your Master Password.
On our servers, we identify all the hashed passwords on our list that begin the same way as your hashed Master Password. We create a new list of potential matches for your Master Password. We send this list, which usually has thousands of hashed passwords, back to the device where you signed in to Arrow.
On your device, we compare the full hash from your Master Password with the list of hashes from the dark web. If we find a match, we know that your Master Password is on the dark web, but we still don't know your Master Password. We notify you so you can change your Master Password and protect your account.
Note: We use a method known as "k-anonymity" to group hashed passwords together based on the first part of the hash. It's already extremely difficult to guess any password based on its hash. Grouping the hashes adds another layer of protection by hiding each password in a crowd of similar hashes.
How do Master Password alerts work?
Master Password alerts use a highly secure process to check if a password matching your Master Password has been found on the dark web without revealing your password to anyone. This process happens once daily on each of your devices when you enter your Master Password in our app.
Important: Master Password alerts uphold our zero-knowledge approach to security and don't reveal your Master Password to us or anyone else.
Security details regarding Master Password alerts
If we think your password is on the dark web, we'll alert you the next time you open the Arrow Smart Extension. Select Open settings to go to your security settings and change your Master Password. You can also select Skip for now to dismiss the alert.
We also alert you in the Security settings section of our web and mobile apps. This alert stays until you change your Master Password. Select Change Master Password as soon as possible to update your password and secure your data.
Customers with paid plans will also see alerts in the Dark Web Monitoring section of their apps.
What do I do if I get an alert about my Master Password?
If we notify you that a password matching your Master Password has been found on the dark web, change your password immediately. Make sure your new password is strong, unique, and easy to remember.
Important: The security alert won't disappear until you change your Master Password. This alert means that the security of your Arrow account is at risk. The best way to secure your account is to change your Master Password to a strong password that you don't use anywhere else.
Change your Master Password
Create a strong Master Password
We recommend turning on 2-factor authentication (2FA) for your Arrow account. With 2FA turned on, no one can access your account without access to your mobile device, even if they have your Master Password.
You can also check if any unknown devices have been using your account. Go to the list of devices you've added to your Arrow account and remove any you don't recognize.
Turn on 2FA for your Arrow account
Manage your devices
How do Master Password alerts protect my organization?
We know our professional plan admins are particularly concerned about the damage compromised passwords can cause to their organization.
In the past, admins had to rely on employees to create strong and unique passwords to protect the organization. If a plan member used the same simple password for all their accounts, including Arrow, we couldn't know if that password had been compromised.
With Master Password alerts, your employees will get an alert if their Master Password is found on the dark web. We'll ask them to change their Master Password as soon as possible. This feature helps strengthen your organization's security and empowers employees to protect their accounts proactively.
Steps to take if you get a Master Password alert
Important: Master Password alerts uphold our zero-knowledge approach to security and don't reveal your Master Password to us or anyone else.
Security details regarding Master Password alerts
Dark Web Monitoring alerts
Dark Web Monitoring alerts come with all Advanced, Premium, and Friends & Family plans as well as professional plans. Dark Web Monitoring alerts aren't included in Arrow Free or free trials of our paid plans.
With Dark Web Monitoring, Arrow scans the web for any of your personal information that someone else may have accessed illegally. Then, we send you an alert if we find something. If your personal information appears on the dark web, your data may be involved in a breach.
Sign up for a professional plan with Dark Web Monitoring.
How does Dark Web Monitoring work?
Step 1: You choose the email addresses you want to track with Dark Web Monitoring. You can choose up to five addresses.
Note: When you add an address, you'll get an email asking you to verify your request. You can add the same email addresses to Dark Web Monitoring in multiple Arrow accounts, but you need to verify the email address each time.
Step 2: Arrow scans the dark web for personal information related to that address. We look for these types of personal info and more:
- Usernames
- Passwords
- Contact information
- Credit cards
- Social Security numbers and other ID numbers
- Computer IP addresses
Step 3: If we find anything, we give you a report with everything we found, and we ask you to change passwords for any compromised logins. The report appears in the Arrow app after you confirm your email address. If we don't find anything, we'll tell you the good news and ask if you want to monitor other email addresses.
Step 4: We continue to scan the dark web and let you know if any new breaches affect your personal info. If we find anything to worry about, we will alert you with a pop-up the next time you open Arrow. You can also find any current alerts in our app's Dark Web Monitoring section.
Sign up for a professional plan with Dark Web Monitoring.
Turn on Dark Web Monitoring
Turn on Dark Web Monitoring in the web app
- Go to the Dark Web Monitoring section in the side menu of the web app.
- If this is your first time using Dark Web Monitoring, select Monitor your first email. If you already use Dark Web Monitoring for other email addresses, select Add email.
- Enter the email address you want to monitor and select Send activation link.
- Look in your inbox for an email from Arrow asking you to confirm. Open the email and select Yes, I confirm this request. You'll be taken to a confirmation page. Select See results to go back to the Arrow app.
Your email address is marked Pending verification in Arrow until you verify your address in your inbox. The link sent to your email stays valid for 24 hours. If you didn't receive the email, check your spam folder. After verification, your email address will be marked Monitoring.
Turn on Dark Web Monitoring in the Android app
- Select the three parallel lines to open the menu and select Dark Web Monitoring.
- If this is your first time using Dark Web Monitoring, select Start monitoring. If you already use Dark Web Monitoring for other email addresses, select the down arrow for the list of monitored emails and select Add email.
- Enter the email address you want to monitor and select Confirm. Then select Open my email app to look for your confirmation email.
- Look in your inbox for an email from Arrow asking you to confirm. Open the email and select Yes, I confirm this request. The email address is marked Pending your verification in Arrow until you verify your address. The link sent to your email stays valid for 24 hours. If you didn't receive the email, check your spam folder.
Turn on Dark Web Monitoring in the iPhone app
- In the Tools section of the bottom menu of the Arrow iPhone app, select Dark Web Monitoring.
- If this is your first time using Dark Web Monitoring, select Start monitoring. If you already use Dark Web Monitoring for other email addresses, select the down arrow for the list of monitored emails and select Add email.
- Enter the email address you want to monitor and select Start monitoring.
- Look in your inbox for an email from Arrow asking you to confirm. Open the email and select "Yes, I confirm this request." The email address is marked Pending your verification until you verify your address. The link sent to your email stays valid for 24 hours. If you didn't receive the email, check your spam folder.
What do I do when I get a Dark Web Alert?
When you get a Dark Web Alert, a pop-up appears the next time you open the Arrow app. You can also view alerts in the Dark Web Monitoring section of the Arrow app or the Password Health section when you select the Compromised tab. We recommend changing any passwords related to the alert as soon as possible.
- View the details of the alert in the pop-up notification or the Dark Web Monitoring or Password Health sections of the Arrow app.
- Go to the website or app affected by the alert and change your password. Then make sure to update the login in Arrow.
- Delete the alert in the Dark Web Monitoring section of the Arrow app. In the web app, select the X for the alert. In the mobile app, select the alert and select Delete alert. When you update a compromised password, your Password Health score updates automatically.
Note: You may receive alerts for logins that you haven't stored in Arrow. These alerts are labeled "unknown website."
Want to learn more? Check out this article:
My information has been compromised or found on the dark web
Is Dark Web Monitoring secure?
Yes. We download the dark web data we use in Dark Web Monitoring to our servers. We don't transfer this data or the email addresses you add to Dark Web Monitoring to anyone else. When you add an email to Dark Web Monitoring, we only use the address to perform the dark web scan.
Our dark web data includes more than 12 billion records attached to hacks and data breaches, and we add nearly a million new records every day. We partner with the leading online intelligence company SpyCloud to provide this data.
Want to protect your information before a breach happens?
Learn about Password Health
Protect your logins with 2FA
Read about Arrow's security and compliance at trust.dashlane.com
Check out our blog posts on password tips and bad password examples
Comments
0 comments
Please sign in to leave a comment.