10 ms·
Dropbox prompts password resets
- rbritton 10y ago> We are prompting a password update purely as a preventive measure. We have no indication your account was improperly accessed. Preventative of what? In case they were compromised and don't know it? I have zero reason to suspect my own password file has been compromised, so there's no reason on my side to change it.
- dchuk 10y agoMaybe they changed their password hashing scheme at some point around 2012, so they're trying to get everything aligned? No idea really, just a thought I had reading that same sentence. Or they have an issue they don't want to talk about and this is one way to get it resolved...
- PolCPP 10y agoThey could update hashes on login if needed. So i guess its something they don't want to talk about
- matthewrudy 10y agoTrue point. That's normally how you'd do a hashing upgrade * decide an upgrade window * each time a user logs in check their hash version, upgrade if necessary * the upgrade period expires * if you can, force log out all non-upgraded users - hoping they'll now log in and get auto-upgraded * email all non-upgraded users and ask them to update their password Hopefully that set of users is now very small.
- teach 10y agoThe reason is explained in the linked article: "We learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012. Our analysis suggests that the credentials relate to an incident we disclosed around that time."
- rmvt 10y agothat's a shitty thing to do imo. they first lure their users into a false sense of security with "This is purely a preventative measure (...)" and only provide an explanation if you go through the linked article. they screwed up. yes, it was 4 years ago but they did. they should acknowledge it in the most simple manner.
- wingcommander 10y agoI also received this email, even though I changed my password this February since my laptop was stolen... Strange
- ljoshua 10y ago> Our security teams are always watching out for new threats to our users. As part of these ongoing efforts, we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012. Our analysis suggests that the credentials relate to an incident we disclosed around that time. Sounds reasonable. I wouldn't be surprised if hashing techniques have changed since then, and this would be another way of upgrading users to the stronger scheme.
- pixelcort 10y agoThis line of reasoning always confused me. To upgrade to a stronger scheme, couldn't a service just rehash the prior hashes subsequently with a stronger scheme? So for those users you'd have newScheme(oldScheme(password)). Then you could do a one-time migration of users with older scheme to increase the security to the new one.
- mintplant 10y agoThanks for posting this. Fortunately I'm not one of the ones affected, but I took the opportunity to rotate my Dropbox password and audit/prune my authorized devices. https://www.dropbox.com/account/security https://www.dropbox.com/account/security I had a bunch of old devices in that list and removing each one triggered a full page refresh, which took longer than normal thanks to the JS-driven single-page design of the dashboard. The removal request itself went over AJAX, so I guess someone figured it was easier to throw away the page state every click than to remove an element from the list's DOM. Made the whole thing much more tedious than it needed to be; a form with a series of checkboxes and a single "remove" button at the bottom would have done fine.
- greg5green 10y agoWeird, just removed an old laptop from mine and didn't trigger a full page refresh.
- klackerz 10y agoIt's triggering full page refresh on removing devices for me, but not on removing old web sessions.
- jedberg 10y agoDid the exact same thing, had the exact same experience. I had a lot of really old devices on there.
- hkjgkjy 10y ago> so I guess someone figured it was easier to throw away the page state every click than to remove an element from the list's DOM. Yet another reason to love what React and other virtual dom libs give us
- acdha 10y agoCan we leave the toolkit evangelism to a different thread? The subject is behavior which was routinely implemented better in the mid-90s without using JavaScript at all.
- mariusc23 10y agoI received an email from @dropboxmail.com about this. I figured it was a phishing attempt... I guess not.
- Spiritus 10y agoWhy aren't they using dropbox.com instead of the suspicious looking dropboxmail.com?
- wodenokoto 10y agoFacebook does/did the same. Must be some reason for it.
- inertial 10y agoOne reason could be to not let spam reports on dropboxmail.com affect the primary domain's reputation (which is also used for corporate communication). If for any reason, the reputation of dropboxmail.com is compromised, they can move on to dropboxmail-1.com etc.
- eriknstr 10y agoI began investigating DNS records to determine if there was some way there to conclusively ascertain that dropboxmail.com was legitimately owned by Dropbox. I could not find a way to determine this through DNS. Next, I went to dropboxmail.com in my web browser, which redirected me to a page on dropbox.com [0] assuring me that dropboxmail.com was owned by dropbox.com. [0]: https://www.dropbox.com/en/help/217 https://www.dropbox.com/en/help/217
- jamesdwilson 10y agoThe redirection is not a valid way to test ownership as an attacker can easily redirect.
- baby 10y ago> Have not changed their password since mid-2012 I changed my password since then, still received the email, mmmm
- tdkl 10y ago> I received the email about this, but haven’t been prompted to update my password—what should I do? > If you received the email but were not prompted to update your password, then you do not need to do so. This means that you did not meet the criteria. We’re prompting the update for users who haven’t changed their Dropbox password since mid-2012[1]. [1] https://www.dropbox.com/help/9257?oref=e https://www.dropbox.com/help/9257?oref=e
- akg_67 10y agoJust curious, what happens if someone doesn't visit dropbox.com and login to the account? Do all devices connected to Dropbox with app lose connectivity?
- jbverschoor 10y agoAll authentication tokens seem to keep working.
- GirlsCanCode 10y agoI switched to onedrive a few weeks ago. Glad I did! It's a better deal, too.
- chmars 10y agoI had received the mail but was not prompted to update my password when I signed in … should I be worried?
- Dolores12 10y agowhen in doubt just change your password
- sambe 10y agoThis is strange. I thought I'd changed my password in that time, but received the email. However, I'm not prompted to change my password when I log in. Now it's unclear to me if they think I should do this manually or not. Anyone else see this?
- gjm11 10y agoThis page says: > we learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012. Our analysis suggests that the credentials relate to an incident we disclosed around that time. There's a link to a page about that "incident", which says: > * usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts.* [...] A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. This doesn't add up, does it? I mean, their account of the incident in 2012 is usernames and passwords were stolen from other accounts; this got the attackers into a Dropbox employee's Dropbox account; that contained "a project document with user email addresses". But now they're saying that "email addresses plus hashed and salted passwords" went astray. It seems to me that there's an important distinction between losing "a project document with user email addresses" and losing one with user email addresses plus password hashes.