5 ms·

> As for Dropbox, they seem to have handled this really well. I'm biased, but I can't agree with this. From what I can tell, there are two communications from

by zaroth 10y ago

> As for Dropbox, they seem to have handled this really well. I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. In 2012 they did not disclose that hashes were stolen, so I don't see how it's really relevant. In the latest communication, they don't actually explain the risk to the user. They say it is "purely as a preventative measure" but if salts and hashes were accessed, then that is not the case. Just because Troy doesn't have access to some of the salts, doesn't mean the attacker doesn't have access. We don't know how many iterations of SHA-1, but SHA-1 can be run by a single GPU on the order of billions of times per second. So unless Dropbox is coming out and saying they know for certain that random 128-bit salts were definitely not accessed by the attacker, almost all of the SHA1 hashed passwords are getting cracked. Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised. As for the salted/bcrypt passwords, we can see from Troy's hash they used $2a$08$ which is bcrypt with a cost factor of 8 -- 2^8 iterations. Gosney's latest rig [3] could crack these bcrypt hashes at about 105,700 / 8 = 13,212 per second. That's not terrible, but that's still 416 billion tries in a year for a modest investment. [1] - https://blogs.dropbox.com/dropbox/2012/07/security-update-new-features/ https://blogs.dropbox.com/dropbox/2012/07/security-update-ne... [2] - https://blogs.dropbox.com/dropbox/2016/08/resetting-passwords-to-keep-your-files-safe/ https://blogs.dropbox.com/dropbox/2016/08/resetting-password... [3] - https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

Xylakant 10y ago
> > As for Dropbox, they seem to have handled this really well. > I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. Especially given that 2012 they assured me that no credentials were lost and this time they didn't even inform me since my account was deleted in the mean time. So it's more or less luck that I know that my old password was compromised.
ethicalhack3r 10y ago
See my comment here: https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_hack_is_real/d73wjv6 https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_...
nxzero 10y ago
>> "Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised." This should be assumed regardless of what is known if it's know a breach happened; meaning basic password hygiene should be followed, and I'm the case of Dropbox, if a user had any plaintext files with passwords to other accounts (yes, people still do this) - they need to change those passwords too.
- psook 10y ago
  Right, but you're assuming optimal response from every Dropbox user, when I'd assume the vast majority of Dropbox users aren't aware of best password practices (or are aware and only change passwords when forced anyway because 'I have nothing to hide'). The severity of the breach means Dropbox should be forcing password changes. I didn't even receive an e-mail notifying of the breach. Nothing in the spam filters, it's just not there. The only reason I'm aware of it is Troy Hunt, and the only reason I'd ever be aware of it is that. I was getting ready to leave dropbox anyway, this just reasserted that it's the correct decision.
  - nxzero 10y ago
    Honestly, I've found security bugs in Dropbox using it (oddly) as designed in the past and would never use it again; basically, as a non admin I could become an admin in a business account; reported the issue, had a call with them and it appeared they fixed it, but still it was a wtf moment for me given if you're an admin you are able to permanently delete all the data and according to Dropbox the data would not be recoverable regardless of the time frame. As for the average user, to be honest at the point I increaslying feel like people are responsible for their own security and if you that concerned a service won't notify you of a breach or make a mistake that to you is unforgivable — don't use them. Reason I take this position now is because increased you feel like all the hand holding related to security is dangerous long-term.
    - psook 10y ago
      I agree that, ultimately, the only person who really cares about your security is you. That is certainly where the buck stops, and if a service has security you don't agree with stop doing business with them. However, a forced password and session reset on accounts whose credentials have become public knowledge isn't "hand holding." It's SysAdmin101. It should be the first thing you do. Unless I'm misreading you, the stated stance is "Anyone using dropbox got what they deserved," but not everyone has the knowledge to perform a security audit. The user is not without blame or having made mistakes, but Dropbox isn't taking ownership of their own mistakes or being transparent to every affected user about what those mistakes were and/or led to. If they want to be a service that does hand-holding, they can give the correct advice. If they don't, they NEED to be transparent about what occurred and what information was released or the onus is entirely on them. Right now, they're doing neither. I think that is criminally negligent, though I'm certain no legal action will be taken. I feel that lowering those expectations of a service only helps justify these shitty, lazy practices to others. The only thing that would've been exposed in the breach relating to me are the e-mail address and password for that service itself (alongside all the crappy memes I stored there), but I'm not ready to watch the world burn from the sidelines. The security of others is just as much your personal security, and the more of it others sacrifice the more you'll be expected to do the same and suffer repercussions for not doing so.
erikb 10y ago
I don't remember the details, but I remember that it was really awful how they handled it back in 2012. Really thought about dropping them (small pun intended). I am very happy to see that they got better, but am still a little sceptical.
arprocter 10y ago
The email they sent out completely neglects to mention that there was a breach unless you follow a link: "We’re reaching out to let you know that if you haven’t updated your Dropbox password since mid-2012, you’ll be prompted to update it the next time you sign in. This is purely a preventative measure, and we’re sorry for the inconvenience. To learn more about why we’re taking this precaution, please visit this page on our Help Center. If you have any questions, feel free to contact us at password-reset-help@dropbox.com"
summarite 10y ago
Horrible communication, much more important than to force a change on the site itself is to say to all users: look, your passwords are at risk, if you reused them change them now. All that in a way that non-techies can understand. Else we can all just wait for the millions of compromised accounts.

by zaroth 10y ago

Xylakant 10y ago

> > As for Dropbox, they seem to have handled this really well. > I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. Especially given that 2012 they assured me that no credentials were lost and this time they didn't even inform me since my account was deleted in the mean time. So it's more or less luck that I know that my old password was compromised.

ethicalhack3r 10y ago

See my comment here: https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_hack_is_real/d73wjv6 https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_...

nxzero 10y ago

>> "Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised." This should be assumed regardless of what is known if it's know a breach happened; meaning basic password hygiene should be followed, and I'm the case of Dropbox, if a user had any plaintext files with passwords to other accounts (yes, people still do this) - they need to change those passwords too.

psook 10y ago
Right, but you're assuming optimal response from every Dropbox user, when I'd assume the vast majority of Dropbox users aren't aware of best password practices (or are aware and only change passwords when forced anyway because 'I have nothing to hide'). The severity of the breach means Dropbox should be forcing password changes. I didn't even receive an e-mail notifying of the breach. Nothing in the spam filters, it's just not there. The only reason I'm aware of it is Troy Hunt, and the only reason I'd ever be aware of it is that. I was getting ready to leave dropbox anyway, this just reasserted that it's the correct decision.
- nxzero 10y ago
  Honestly, I've found security bugs in Dropbox using it (oddly) as designed in the past and would never use it again; basically, as a non admin I could become an admin in a business account; reported the issue, had a call with them and it appeared they fixed it, but still it was a wtf moment for me given if you're an admin you are able to permanently delete all the data and according to Dropbox the data would not be recoverable regardless of the time frame. As for the average user, to be honest at the point I increaslying feel like people are responsible for their own security and if you that concerned a service won't notify you of a breach or make a mistake that to you is unforgivable — don't use them. Reason I take this position now is because increased you feel like all the hand holding related to security is dangerous long-term.
  - psook 10y ago
    I agree that, ultimately, the only person who really cares about your security is you. That is certainly where the buck stops, and if a service has security you don't agree with stop doing business with them. However, a forced password and session reset on accounts whose credentials have become public knowledge isn't "hand holding." It's SysAdmin101. It should be the first thing you do. Unless I'm misreading you, the stated stance is "Anyone using dropbox got what they deserved," but not everyone has the knowledge to perform a security audit. The user is not without blame or having made mistakes, but Dropbox isn't taking ownership of their own mistakes or being transparent to every affected user about what those mistakes were and/or led to. If they want to be a service that does hand-holding, they can give the correct advice. If they don't, they NEED to be transparent about what occurred and what information was released or the onus is entirely on them. Right now, they're doing neither. I think that is criminally negligent, though I'm certain no legal action will be taken. I feel that lowering those expectations of a service only helps justify these shitty, lazy practices to others. The only thing that would've been exposed in the breach relating to me are the e-mail address and password for that service itself (alongside all the crappy memes I stored there), but I'm not ready to watch the world burn from the sidelines. The security of others is just as much your personal security, and the more of it others sacrifice the more you'll be expected to do the same and suffer repercussions for not doing so.

erikb 10y ago

I don't remember the details, but I remember that it was really awful how they handled it back in 2012. Really thought about dropping them (small pun intended). I am very happy to see that they got better, but am still a little sceptical.

arprocter 10y ago

The email they sent out completely neglects to mention that there was a breach unless you follow a link: "We’re reaching out to let you know that if you haven’t updated your Dropbox password since mid-2012, you’ll be prompted to update it the next time you sign in. This is purely a preventative measure, and we’re sorry for the inconvenience. To learn more about why we’re taking this precaution, please visit this page on our Help Center. If you have any questions, feel free to contact us at password-reset-help@dropbox.com"

summarite 10y ago

Horrible communication, much more important than to force a change on the site itself is to say to all users: look, your passwords are at risk, if you reused them change them now. All that in a way that non-techies can understand. Else we can all just wait for the millions of compromised accounts.