75 ms·
The Dropbox hack is real
- jbverschoor 10y agoHow can I tell if someone has accessed my account / files?
- jsmthrowaway 10y agoRepeating from the other thread: I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance. HIBP is a truly essential service and I'd be happy to pay more. Even with good password discipline it's useful knowledge on your exposure and I cannot recommend it enough. He mentions it near the end but this is one of those no brainers that should be repeated very loudly. https://haveibeenpwned.com https://haveibeenpwned.com
- djhworld 10y agoThanks for linking to this site, it says my address was breached in Dropbox, LinkedIn, Gawker media(?) and Tumblr I changed my Dropbox password last week after they sent the email, same with LinkedIn. Great site though
- ashitlerferad 10y agoIt really is about time we stopped using passwords.
- markild 10y agoHonestly curious, what should we use?
- ashitlerferad 10y agoPublic-key crypto. Client side X.509 certificates for the web. S/MIME and OpenPGP keys for email. OpenSSH keys for SSH. etc
- mrsirduke 10y agoWe tried using X.509 certificates in Denmark for proving your identity to the state. It was a complete nightmare unless you understood what public key crypto is, how it works, and how to configure your browser for it. Don't get me started about having to move your certificate/keys around. It doesn't work for the masses.
- ashitlerferad 10y agoSo when are the browser vendors going to fix their interfaces?
- technomancy 10y agoThere's a world of difference between a well-designed pubkey interface like ssh-agent and what you get in today's browsers. I don't know how feasible it would be to replace passwords for the general public, but if browser vendors were actually serious about security, they could go a very long way towards making client certs feasible just by giving up on their current strategy of putting their fingers in their ears and pretending it doesn't exist.
- JorgeGT 10y agoSomething similar in Spain, your mandatory ID card is a smart card, and you can also ask for free personal certificates from the Royal Mint. Works really great to do paperwork from home, but only a minority uses it.
- laxatives 10y agoI'd love it if every time I wanted to log in, I entered my username/email, saw a two factor-auth, and had an email sent with a time sensitive link containing my session credentials. But this would be a pain in the ass if I had a slow connection or used an old email address. And worse, it be totally unsafe if I could (easily?) change the email address attached to the account.
- kkhire 10y agomagic link. That's what medium does for email logins, and slack offers the option as well. it's easily one of the safest methods
- arianvanp 10y agoThough slack magic links always stay valid... Leaving a nice plain text password for all MTAs that forward my mail.
- markild 10y agoAh.. Yes, but that will leave anyone that has somehow gotten access to my mail to suddenly have access to all my accounts then, wouldn't it?
- ascorbic 10y agoThey already do if they have password reset over email. That's why you need 2FA.
- deleted 10y ago[deleted]
- treahauet 10y agoAgreed. I've just donated, and the link for that is https://haveibeenpwned.com/Donate https://haveibeenpwned.com/Donate
- donw 10y agoSince lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.
- epimenov 10y ago1Password can do 2FA, also syncs between all your devices. And no trusted 3rd party cloud service.
- jonathanoliver 10y agoKeeping all the keys (password and 2FA tokens) in 1Password means it isn't true 2FA anymore: https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-factor/ https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-...
- epimenov 10y agoThey're actually talking about 2FA for 1password itself. Not supporting TOTP via 1password for other services.
- TTPrograms 10y agoNote the hack was in 2012. Hopefully most people have rotated passwords by now.
- ashitlerferad 10y agoAnyone know of automated ways to rotate all the passwords on all of our accounts across the web?
- emillon 10y agoIt's a common feature of password managers.
- willvarfar 10y ago50% of the leaked hashes were bcrypt and the other 50% were salted sha1. So, asking the HNers who crack passwords or follow the tech closely and have a good feel: Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt? And how can this be projected to change in the next couple of years?
- cm2187 10y agoMostly what Troy says is that the sha1 were salted with a salt not available in the files he was provided. That doesn't mean the salt wasn't leaked. But if it wasn't, and the salt was a 128bit, unique to each password, cryptographic random salt, I'd say they are not really vulnerable. So it depends on the strength, randomness and availability of the salt.
- tonicoto 10y agoHow come the salts aren't available? Did the attacker choose not to release them, or were they stored elsewhere?
- Klathmon 10y agoOr were they really bad salts? Like a hash of the username?
- mnw21cam 10y agoThat wouldn't really be a proper salt, although technically it would fulfil the purpose of a salt, which is to prevent lookup tables being used.
- Klathmon 10y agoOh I agree, but I've seen too many "clever" systems which derive the salt from something like the username or another field or fields in the DB. Just because there is no obvious salt now doesn't mean it's not there. Only Dropbox knows how it worked at this point.
- aluhut 10y agoSelf hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it on a stick or on your damn phone...why taking more risks especially facing this massive fail here?
- thomasahle 10y ago> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?
- danieldk 10y agoIt's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data. (Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com https://librevault.com)
- whyagaindavid 10y agoWhy not use firefox sync or chrome password sync? All data is locally encrypted before uploading.
- aluhut 10y agoBoth.
- m0nty 10y ago
- aorth 10y ago@dang Can we please change the URL to not have the query parameters?
- ashitlerferad 10y agoI'd go with automatically stripping all utm_* query parameters from all URLs.
- MichaelApproved 10y agoWhat's the harm?
- 10011100 10y agoHello Michael, We noticed some of the websites you read, and were wondering if you'd like to buy some stuff? A lot of the stuff we're selling is directly related to what you were reading about just five minutes ago! Are you interested in spending money on our stuff? Click here to find out more! Would you like to fill out a survey, and be entered into a contest to win our stuff. It's fast, fun and easy! Try it now! Here are some other articles we thought you might like. Is this ad irrelevant? Tell us how!
- hackernews2000 10y agoI do it with this extension: https://github.com/einaregilsson/Redirector/ https://github.com/einaregilsson/Redirector/
- joshschreuder 10y agoSorry about that, I submitted the link directly from my RSS feed. I'll trim that stuff if I submit in the future.
- peteretep 10y agoDropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
- staticelf 10y agoSwitch to SpiderOak: https://spideroak.com/ https://spideroak.com/
- tehbeard 10y agoXkcd's correct-horse-battery-staple technique?
- arianvanp 10y agoCheck out diceware. Easy technique to memorise a lot of entropy
- deleted 10y ago[deleted]
- cm2187 10y agoKeep your password written on a piece of paper in your wallet, with a few extra characters you need to remember to ignore.
- loup-vaillant 10y agoHere's the advanced version, that let you use different, mostly uncorrelated passwords for different services. http://blog.jgc.org/2010/12/write-your-passwords-down.html http://blog.jgc.org/2010/12/write-your-passwords-down.html I have implemented a little program to generate such a square: http://loup-vaillant.fr/projects/password-generator http://loup-vaillant.fr/projects/password-generator Though by now, I find this a little tedious. I'm thinking of using an encrypted password database, protected with a diceware generated password. That way I will be able to copy&paste my passwords instead of typing them by hand.
- 0x0 10y agoIt was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could see your pattern and start spamming by guessing popular services. On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no-password-required/ http://www.cnet.com/news/dropbox-confirms-security-glitch-no...
- cm2187 10y agoI cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.
- markdown 10y ago> Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how chip-and-pin works?
- cm2187 10y agoExcept that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.
- chrisseaton 10y ago> the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.
- cimnine 10y agoI wonder if they got the seeds ('secret key' in [1]) for the 2FA as well. [1] https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm#Definition https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A...
- danieldk 10y agoThis hack precedes the introduction of 2FA on Dropbox: https://blogs.dropbox.com/dropbox/2012/07/security-update-new-features/ https://blogs.dropbox.com/dropbox/2012/07/security-update-ne...
- raverbashing 10y agoI wonder why the SHA1s don't have the salt. Were they removed so that only the original owners have it so it's easier to crack? Oh well, another HIBP entry with my email address...
- deleted 10y ago[deleted]
- dbg31415 10y agoWhy isn't Dropbox reporting this? I'd have more respect for them if they were more honest about this.
- lloeki 10y agoThey sent both me and my wife an email a couple of days ago regarding this, and have a Help Center page[0] for it: Hi <first name>, We’re reaching out to let you know that if you haven’t updated your Dropbox password since mid-2012, you’ll be prompted to update it the next time you sign in. This is purely a preventative measure, and we’re sorry for the inconvenience. To learn more about why we’re taking this precaution, please visit this page on our Help Center. If you have any questions, feel free to contact us at password-reset-help%dropbox.com. Thanks, The Dropbox Team [0]: https://www.dropbox.com/help/9257 https://www.dropbox.com/help/9257
- akerro 10y agoThey were preparing to start IPO, so they must be very careful with words they use now.
- AjithAntony 10y agoThey told us a week ago https://blogs.dropbox.com/dropbox/2016/08/resetting-passwords-to-keep-your-files-safe/ https://blogs.dropbox.com/dropbox/2016/08/resetting-password...
- gowthamgts12 10y agoWhy these troyhunt guys place a clickbait to hibp in every article? Don't be sick
- tonicoto 10y agoWell, let's reply to the obvious troll. Troy Hunt is a person, not a team, and I guess he links to HIBP because he's proud of his work. I know I would.
- shostack 10y agoYou forgot to add that it is also an incredibly valuable service for times like these that is totally free. At this point I'd say signing up for notifications with it is just a solid security practice.
- pacman143 10y agoBecause that is one mans war to help millions who have been pawned.
- omginternets 10y agoHIBP says I was pwnd. So ... like ... what do I do now? SHA-1 hashes should still be okay, right?
- dijit 10y agoChange your passwords; especially if you use the same password for many things. you're not alright, we have a way of knowing if that was your password or not and having unlimited tries with unlimited processing power, which means it's a matter of time before someone is able to guess their way into your accounts.
- 16556 10y agoChange your password at Dropbox and any sites you re-use that password on (which you really shouldn't be doing).
- VeejayRampay 10y agoCan someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical people. EDIT: Thanks everyone for your answers, this is a good example of the power of communities.
- staticelf 10y agoUnique passwords for each site (I use a password manager) and add two factor auth whenever possible.
- Mahn 10y agoPassword manager + two factor authentication whenever possible. As for the former: Opinions here differ but my recommendation would be not to trust a "cloud" password manager and employ an offline password manager instead. KeePass works great for instance and is open source and cross-platform.
- tallanvor 10y agoWhile an offline password manager is inherently more secure, at some point you're either going to have to store the database on a cloud somewhere or worry about constantly keeping your databases in sync. Whether you store it in Dropbox/OneDrive/Google/etc. or use LastPass or another service, there's always going to be some risk. At present I still recommend LastPass because that way you can easily have everything synced on your computers, phone, etc., and it's easier to convince people to remember one strong password and let LastPass handle remembering all the other strong passwords no matter what device you're on.
- Mahn 10y agoSure, with an offline password manager backups and synchronization are up to you, but even if you end up relying on cloud storage it's a different story; for instance, if you store your KeePass database on a Dropbox account and said Dropbox account gets breached, at least you know that unless there's a flaw in the encryption algorithm used by KeePass, the password database cannot be decrypted without the master password (and brute forcing it should be very impractical if the master password is good enough). If you use service like LastPass or 1Password you can never be entirely certain that a breach or a security flaw in any of these services isn't going to expose your passwords. I'm sure they use the proper encryption measures, but like the Dropbox breach shows, shit happens and companies get hacked. I'm not saying never use a cloud password manager, but understand that the added convenience comes with added risk; I would definitely not make my company depend on them.
- sureshn 10y agoRecently I had received an email from Dropbox asking me to change my password and now I read about the hack , I wonder if there is any correlation here.
- oxplot 10y agoMake sure you sign yourself up for something like https://haveibeenpwned.com https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.
- shostack 10y agoCan't upvote hard enough. Also, it is shocking how bad security is for all these games I've played over the years. The publishers seem to be the source of the vast majority of these leaks I've been caught in. Thankfully the notification emails from this service are prompt and helpful (not to mention totally free).
- thieving_magpie 10y agoAlso note the guy that runs it is the one that wrote this article.
- rajathagasthya 10y agoWow, thanks for this. I just found out that my email address was breached 3 times, while only one company sent an email informing me of the breach.
- hatsix 10y agoAlso, LastPass uses a similar site, plus it's specific knowledge of your passwords (last time it was changed), to let you know if a password has been compromised. Not sure if 1Password does as well, but it seems like a fairly obvious feature to add.
- irq 10y agoIt does.
- cmg 10y ago1Password has a "Watchtower" feature that "identifies websites that are vulnerable to Heartbleed". Also under Security Audit are sections for Weak Passwords, Duplicate Passwords, and groupings of password ages (3+ years old, 1-3 years old, 6-12 months old for me). It does not appear to keep track of leaks/hacks. https://watchtower.agilebits.com/ https://watchtower.agilebits.com/
- chinathrow 10y agoGreat read. He goes on to say that 1Password has a subscription now and that you should signup for it. No. I will never, ever put all my passwords into a cloud based password store. I simply do not trust them to not fuck it up at one point in time. Am I alone with this view?
- aianus 10y ago1Password is not cloud based...
- chinathrow 10y agohttps://1password.com/privacy/ https://1password.com/privacy/ For some products, they are. "Your vaults, items, and documents are fully encrypted in your 1Password Families and 1Password Teams and stored on our servers."
- martin-adams 10y agoIf find this just interesting that just last week my steam account was successfully logged in from Russia (I'm in the UK). Looks like I forgot about Steam to make my passwords stronger.
- andypants 10y agoI turn on 2FA wherever I can now. If only steam supported modern 2FA and not sending a code via email.
- martin-adams 10y agoAgree. If they support Google Authenticator, even better. Sometimes the text messages don't come through.
- blakeyrat 10y agoThey do-- IF you own an Android or iOS phone. If you own a Windows Phone, you're just screwed.
- Ffaine 10y agoI've never trusted dropbox, cloud etc. They drive me paranoia. :/
- zaroth 10y ago> As for Dropbox, they seem to have handled this really well. I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. In 2012 they did not disclose that hashes were stolen, so I don't see how it's really relevant. In the latest communication, they don't actually explain the risk to the user. They say it is "purely as a preventative measure" but if salts and hashes were accessed, then that is not the case. Just because Troy doesn't have access to some of the salts, doesn't mean the attacker doesn't have access. We don't know how many iterations of SHA-1, but SHA-1 can be run by a single GPU on the order of billions of times per second. So unless Dropbox is coming out and saying they know for certain that random 128-bit salts were definitely not accessed by the attacker, almost all of the SHA1 hashed passwords are getting cracked. Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised. As for the salted/bcrypt passwords, we can see from Troy's hash they used $2a$08$ which is bcrypt with a cost factor of 8 -- 2^8 iterations. Gosney's latest rig [3] could crack these bcrypt hashes at about 105,700 / 8 = 13,212 per second. That's not terrible, but that's still 416 billion tries in a year for a modest investment. [1] - https://blogs.dropbox.com/dropbox/2012/07/security-update-new-features/ https://blogs.dropbox.com/dropbox/2012/07/security-update-ne... [2] - https://blogs.dropbox.com/dropbox/2016/08/resetting-passwords-to-keep-your-files-safe/ https://blogs.dropbox.com/dropbox/2016/08/resetting-password... [3] - https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...
- Xylakant 10y ago> > As for Dropbox, they seem to have handled this really well. > I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. Especially given that 2012 they assured me that no credentials were lost and this time they didn't even inform me since my account was deleted in the mean time. So it's more or less luck that I know that my old password was compromised.
- ethicalhack3r 10y agoSee my comment here: https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_hack_is_real/d73wjv6 https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_...
- vladimir-y 10y agobtw Argon2 https://github.com/P-H-C/phc-winner-argon2 https://github.com/P-H-C/phc-winner-argon2 is better than bcrypt for passwords hashing
- watson 10y agoWhat really bothers be about this is that Dropbox hasn't bothered to reset the sessions. Even after I manually reset my password (which I wasn't prompted or forced to do btw), all my apps (iPhone, desktop etc) that have existing sessions wasn't expired. So for all I know, a hacker might already have an open session to my Dropbox and changing the password will not fix that Clarification edit: I did receive the e-mail from Dropbox letting me know that I should change my password, but when visiting dropbox.com I was already logged in and wasn't prompted to perform the pw reset
- sfilipov 10y agoYou can see all the existing sessions and authorised applications from their website. It is not perfect and it is extra work to go through those and delete them, but at least there is a way.
- aantix 10y agohttps://www.dropbox.com/account#security https://www.dropbox.com/account#security Unlink the device to restart the session.
- gwbas1c 10y agoI'm a lead at Syncplicity, a prominent competitor. Early in my career at Syncplicity I changed all of our desktop clients to use long-lived sessions that do not reset when the user's password is changed. For us, this is deliberate for a few reasons. Most of our customers authenticate via their employer's SSO (single sign on) and do not use any Syncplicity password management. We also do not believe that routine password maintenance should force someone to run around and re-authenticate all their computers. (Like Dropbox, a user can log into our web site and remove computers from their account.) I do understand the argument that a password change should force a re-authentication on all clients; but I don't think it's the right approach. Changing a password is reactionary and preventative. An email notification will inform a user that his or her account is compromised.
- erikb 10y agoMaybe one could add a checkbox to allow users to do that when they want to. My Skype password was recently hacked and I'm very very happy that I could via one command logout all the clients. Sometimes it's a feature you really really want to react fast.
- sordidfellow 10y agoSo we finally get validation of https://news.ycombinator.com/item?id=5300492 https://news.ycombinator.com/item?id=5300492
- lllorddino 10y ago> 1Password now has a subscription service for $3 a month and you get the first 6 months for free. Don't pay for this people. Use the open source password manager Keepass http://keepass.info/ http://keepass.info/
- kumarski 10y agothe website is so poorly designed, it leads to consumer-non-adoptability.
- vog 10y agoIndeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine. On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, whose URL is as complicated as: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h...
- trimbo 10y ago> their website is really ugly I don't think it's ugly -- just dated. Isn't it weird that mentally we trust software less if they have a dated website? Shouldn't it be the opposite? (As in: a dated website means this software is mature and tested?)
- funkymike 10y agoThe problem with dated websites is that they have the appearance of being thrown on the web in 10 minutes and forgotten about rather than being mature and tested. If the software is well supported and maintained than the website should be too.
- CriminallyInane 10y agoIsn't the mentality more to do with insecure sites having dated websites with misleading links etc. Unless its a known company a dated/poor website often flags warnings for me about security, support for the product and more.
- cpach 10y agoSo besides resetting the password, should one also unlink devices and apps?
- evan_ 10y agoYou should probably audit the list and disconnect any you don't recognize, but you should probably be doing that periodically anyway with everything...
- Joof 10y agoWhat's the big deal? It's not like it allows attackers to directly modify files on anyone's computer if they have Dropbox installed.
- StanislavPetrov 10y agoIt never ceases to amaze me how people have bought into "cloud" computing. Its hard enough to protect your own data, on your own secure machine. Once you entrust your data to a third party you should have absolutely no doubt that it is at risk. The larger the organization that that third party is, the more inherently insecure it is. In the cloud, it only takes one careless, stupid, or inept person to expose the data of thousands (or millions). And you can't fix stupid. No thanks, I'll keep control over my own data.
- fastball 10y agoI guess it depends on the data we are talking about? I have a huge photo library, but I'm not a professional photographer. I'm not going to sell any of the photos I have on my computer. So when Apple told me I could offload all that data to the cloud, and worry about it less (from a backup perspective), I said "absolutely". Sensitive data is more problematic. But the vast majority of people aren't handling "sensitive" data.
- StanislavPetrov 10y ago>I guess it depends on the data we are talking about? Absolutely it depends. > But the vast majority of people aren't handling "sensitive" data. I don't think that is necessarily true, but it would depend on how you define "sensitive". If you are storing data in the cloud that you are happy sharing with the public, then security isn't an issue. However, many people backup all of their data in the cloud (you need look no further then OneDrive that comes with every copy of Windows 10). This includes their financial information, tax returns, intimate personal information, and other things that would horrify them if they were exposed to the public. Most do so without understanding the risks because cloud computing has been sold so heavily by the government, corporations, and media outlets. And we aren't just talking about individuals. Many, if not most, corporations use cloud computing to store their data. This includes financial data, customer information, credit cards, account numbers, and everything else you can imagine. I'm not trying to argue cloud computing doesn't have its uses. I have no problem using the Steam cloud to save my game in Civilization 5, regardless of how insecure their servers are. But the risks are very real any time you entrust your data (or anything else) to a third party, and they should be recognized.
- danso 10y agoWell, thank goodness I got robbed after 2012, which caused me to change all my passwords everywhere. Else I don't think I would've ever gotten around to changing my Dropbox password, as it's just a long string of randomness.
- achr2 10y agoDropbox should absolutely be held to the flame for trying to downplay the severity of this. Their communication says 'This is purely a preventative measure', but if you had/have reused this password on any other sites (let's face it a huge proportion of non tech savvy people do this) then your entire online presence may be exposed.
- Swizec 10y agoNon tech savvy? Everyone does this. It's practical. Sure most of us have a few passwords we reuse, but I know less than 5 people with truly unique passwords.
- ksenzee 10y agoNo, lots of people use password managers. You should try one.
- simonswords82 10y agoI tried lastpass and it's been nothing but a pain in the arse. I still use it but I frickin' hate it.
- tedmiston 10y agoIf you're on a Mac, 1Password is a monumentally better experience.
- inferiorhuman 10y agoWorks great until it doesn't (multiple user profiles in your browser, HTTP auth, non-browser based stuff like VPNs).
- niteshade 10y agoWouldn't multiple user profiles have their own extensions? If so, then just install the extension on that profile? IIRC 1Password was working on something related to that, so perhaps that has changed recently. HTTP auth not working is a bit annoying, but it's not a massive deal when you can CMD+ALT+\ and copy-paste it. Same deal with non-browser based stuff.
- maherbeg 10y agoWhat sites does everyone have two step verification on? I'm trying to figure out where I need to setup two step verification that also accounts for a phone being stolen/lost. Between gmail, dropbox (1password is synced here), and apple, I'm not sure where I should be enabling it. It seems like everywhere but gmail and apple is probably the right move...
- evan_ 10y agoEnable it everywhere you can, and just write down & guard the backup keys. Also, I don't use it, but 1password can store and backup 2FA keys so you can theoretically recover from a lost phone that way, depending on how you store the 1password vault. Not a replacement for backup keys necessarily.
- maherbeg 10y agoGenerally agree here, but I'm thinking about real scenarios in which I may never be able to recover anything. One scenario is traveling abroad and having my phone stolen/lost.
- jamesgeck0 10y agoFor an iPhone, a full backup via iTunes will include the authenticator app data, won't it? And you'll be printing out emergency passwords when you set up two-factor either way.
- jorblumesea 10y agoFunny, I just got an email a week ago saying they had noticed my password hadn't been changed in awhile (2012, which was interesting based on the article). Sounds like they knew about this and beefed up security.Or, they beefed up security on newer passwords but didn't cut over the old ones? The email did not mention any data theft, kinda wish it did. Too little, too late.
- gjolund 10y agoUse unique passwords ffs.
- Allinsonangie 10y agoI really don’t know much about this scam thing and at the same time , no one wants to be on the losing side . But i just came across a good hacker who helped me hack my boyfriends text messages, whatsap, Facebook , Instagram messages remotely..You don’t have to touch his phone while you have access to his conversations through the software he bought and install remotely on my phone , i dont know how he did this but i think he's perfect at it.....contact him at jonnycyberghost@gmail.com..Tell him Allinson referred you, then you can thank me later. God Bless.
- ljk 10y agomaybe he shouldn't be your boyfriend...
- skinnymuch 10y agoResponding to spam :D
- randyrand 10y agoHow is it possible for Hashcat to crack a 20 character long random password in 6ms? That is mind boggling. I thought he was just going to hash the password and see if it fit the leaked hash, but no, it looks like he actually did the reverse and cracked the hash to see if it fit the password, right? Edit: oh it looks like he provided the password to hashcat in the form of a psudo 'dictionary' to use. So Hashcat was not really cracking it - just iterating through a 1 word dictionary - like he said.
- marco1 10y agoNo, he didn't crack it but just hashed it and checked for equality. So just what you would have expected. He did it in a way that appears more complicated to people using Hashcat not as often as he probably does. Hashcat used the real password as a single-entry password dictionary. So in order to "crack" the hash, it grabbed the first and single entry from its dictionary, hashed it, ... match! Don't worry, this has been confusing to me and several people in the comments section on his website as well.
- update 10y agoI'm surprised no one has mentioned Dropbox's bug bounty program: https://hackerone.com/dropbox https://hackerone.com/dropbox You have to wonder if all those grumbling whitehats were on to something when they said bug bounties should pay a lot more than what they do and that there IS a black market interest for them.
- nevi-me 10y agoI suppose this is off topic, but I checked one of my email addresses on https://haveibeenpwned.com/ https://haveibeenpwned.com/ and found a LinkedIn hack from May 2016. Thing is I've deleted my LinkedIn account thrice in 2013. They have no right to stop have my email after that long.
- manishyt 10y agoThe hack is from September 2012. LinkedIn knew about it in May 2016.
- deleted 10y ago[deleted]
- mjmasn 10y agoHmm, my account appears on HIBP, but Dropbox haven't asked me to change my password on login... Who to believe? (probably not Dropbox)
- nguoiduatin196 10y agohttp://phukhoathaiha.com/ http://phukhoathaiha.com/ Bệnh phụ khoa là bệnh mà đa số phụ nữ đều mắc phải ít nhất một lần trong đời, đây là bệnh viêm nhiễm ở cơ quan sinh dục nữ bao gồm cơ quan sinh dục dưới (âm hộ, âm đạo, cổ tử cung) và cơ quan sinh dục trên (tử cung, vòi trứng và buồng trứng). Tuy là bệnh mà phụ nữ thường gặp nhưng nhiều chị em thường không biết rõ những triệu chứng của bệnh phụ khoa nên rất nhiều người lầm tưởng đó là một bệnh khác. Vậy triệu chứng khi bị nhiễm bệnh phụ khoa là như thế nào?
- andythro77 10y agohi, am Anderson, i had my friend help me hack my ex's email, facebook, whatsapp,and his phone cause i suspected he was cheating. all he asked for was a his phone number. he's email is (cyberlord7714@gmail.com)..IF u need help tell him Anderson referred you to him and he'll help. Am sure his going to help you do it, good luck
- andythro77 10y agohi, am Anderson, i had my friend help me hack my ex's email, facebook, whatsapp,and his phone cause i suspected he was cheating. all he asked for was a his phone number. he's email is (cyberlord7714@gmail.com)..IF u need help tell him Anderson referred you to him and he'll help. Am sure his going to help you do it, good luck
- tannerh 10y agoTannerah@gmail.com
- ommunist 10y agoOK. Thank you, HN. I just discovered that I've been pwned on Dropbox breach. If that happened in 2012, and I am using 1Password sync over Dropbox, does that mean that all my passwords stored in 1Password.pif in 2012 were compromised too? Probably yes.