4 ms·

> We are prompting a password update purely as a preventive measure. We have no indication your account was improperly accessed. Preventative of what? In case

> We are prompting a password update purely as a preventive measure. We have no indication your account was improperly accessed. Preventative of what? In case they were compromised and don't know it? I have zero reason to suspect my own password file has been compromised, so there's no reason on my side to change it.

dchuk 10y ago
Maybe they changed their password hashing scheme at some point around 2012, so they're trying to get everything aligned? No idea really, just a thought I had reading that same sentence. Or they have an issue they don't want to talk about and this is one way to get it resolved...
- PolCPP 10y ago
  They could update hashes on login if needed. So i guess its something they don't want to talk about
  - matthewrudy 10y ago
    True point. That's normally how you'd do a hashing upgrade * decide an upgrade window * each time a user logs in check their hash version, upgrade if necessary * the upgrade period expires * if you can, force log out all non-upgraded users - hoping they'll now log in and get auto-upgraded * email all non-upgraded users and ask them to update their password Hopefully that set of users is now very small.
teach 10y ago
The reason is explained in the linked article: "We learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012. Our analysis suggests that the credentials relate to an incident we disclosed around that time."
- rmvt 10y ago
  that's a shitty thing to do imo. they first lure their users into a false sense of security with "This is purely a preventative measure (...)" and only provide an explanation if you go through the linked article. they screwed up. yes, it was 4 years ago but they did. they should acknowledge it in the most simple manner.
wingcommander 10y ago
I also received this email, even though I changed my password this February since my laptop was stolen... Strange

dchuk 10y ago

Maybe they changed their password hashing scheme at some point around 2012, so they're trying to get everything aligned? No idea really, just a thought I had reading that same sentence. Or they have an issue they don't want to talk about and this is one way to get it resolved...

PolCPP 10y ago
They could update hashes on login if needed. So i guess its something they don't want to talk about
- matthewrudy 10y ago
  True point. That's normally how you'd do a hashing upgrade * decide an upgrade window * each time a user logs in check their hash version, upgrade if necessary * the upgrade period expires * if you can, force log out all non-upgraded users - hoping they'll now log in and get auto-upgraded * email all non-upgraded users and ask them to update their password Hopefully that set of users is now very small.

teach 10y ago

The reason is explained in the linked article: "We learned about an old set of Dropbox user credentials (email addresses plus hashed and salted passwords) that we believe were obtained in 2012. Our analysis suggests that the credentials relate to an incident we disclosed around that time."

rmvt 10y ago
that's a shitty thing to do imo. they first lure their users into a false sense of security with "This is purely a preventative measure (...)" and only provide an explanation if you go through the linked article. they screwed up. yes, it was 4 years ago but they did. they should acknowledge it in the most simple manner.

wingcommander 10y ago

I also received this email, even though I changed my password this February since my laptop was stolen... Strange