7 ms·

Dropbox should absolutely be held to the flame for trying to downplay the severity of this. Their communication says 'This is purely a preventative measure', bu

by achr2 10y ago

Dropbox should absolutely be held to the flame for trying to downplay the severity of this. Their communication says 'This is purely a preventative measure', but if you had/have reused this password on any other sites (let's face it a huge proportion of non tech savvy people do this) then your entire online presence may be exposed.

Swizec 10y ago
Non tech savvy? Everyone does this. It's practical. Sure most of us have a few passwords we reuse, but I know less than 5 people with truly unique passwords.
- ksenzee 10y ago
  No, lots of people use password managers. You should try one.
  - simonswords82 10y ago
    I tried lastpass and it's been nothing but a pain in the arse. I still use it but I frickin' hate it.
    - tedmiston 10y ago
      If you're on a Mac, 1Password is a monumentally better experience.
      - inferiorhuman 10y ago
        Works great until it doesn't (multiple user profiles in your browser, HTTP auth, non-browser based stuff like VPNs).
        niteshade 10y ago
        Wouldn't multiple user profiles have their own extensions? If so, then just install the extension on that profile? IIRC 1Password was working on something related to that, so perhaps that has changed recently. HTTP auth not working is a bit annoying, but it's not a massive deal when you can CMD+ALT+\ and copy-paste it. Same deal with non-browser based stuff.
      - simonswords82 10y ago
        I am on a Mac - I'll check out 1Password thanks
      - Redoubts 10y ago
        Why not just use keychain?
        tedmiston 10y ago
        Two of the most compelling reasons are cross-browser support and a better cross-device experience. For example, viewing/editing Keychain password on an iPhone requires burrowing into the Settings app, whereas 1Password has an excellent app and extension.
- dsacco 10y ago
  Considering the consequences of password breaches, it's decidedly impractical. Password managers make it very easy to have unique passwords for all websites. I don't even know any of my passwords.
  - softawre 10y ago
    Except the one to your password manager :)
    - dsacco 10y ago
      Well, yes :)
    - BinaryIdiot 10y ago
      This scares the crap out of me. I have to remember this one, super long and complex password for my password manager. If I ever accidentally paste it somewhere else, type it in somewhere or somehow it's leaked from the password manager then I am completely screwed. This one, tiny thing can completely turn my life upside down. For sites that require security questions those are easy to game so the only way to be secure is making up answers. So I wouldn't even be able to reset a large amount of very important passwords! I wish we had a better alternative to passwords. Something that's actually good, solid, can't lose or forget. I get the feeling we won't have that until we can start implanting chips in ourselves.
      - tdkl 10y ago
        You just immediately change the master password and delete previous versions of the database file ?
        BinaryIdiot 10y ago
        Not really. If someone gets into someone else's password manager they can easily get a copy of all usernames and passwords and, if they're quick enough, they can start resetting them / closing them / committing fraud. So yeah change the password and delete previous versions is a good first step but everything else has already leaked to who knows where.
- duaneb 10y ago
  I'd argue with a password manager it's more pragmatic to have a different password everywhere. I know two passwords and use my manager for everything.
- em3rgent0rdr 10y ago
  Anyway, tech-savvy folk are more likely to setup their own file-sync server. It is the non-tech-savvy people who are the primary users of dropbox.
  - hughw 10y ago
    Not many tech-savvy people have time to set up and maintain a personal file sync service that works across their laptops, phones, and tablets.
    - corobo 10y ago
      Second bit of data for that claim. I use dropbox because I can't be waffled to set up my own dropbox nor do I have the free time even if I did want to.
- pault 10y ago
  Use an algorithmic password. Pick some easy to remember keyword, then work some of the letters of the website into the password so each site is unique. For example, your seed could be "horse", and your gmail password would be something like "hgomrasiel". I've been doing this for ten years and haven't forgotten a password yet. :)
  - chaz6 10y ago
    I would like to do this, and I thought about using an algorithm that uses the domain name as the seed, however different sites have different password policies, and expiration times which would make this very difficult to manage in practice. I wish all sites support things like OpenID so I can have one central place to sign in with 3-factor authentication.
    - pault 10y ago
      This comes up sometimes but I've found it to be less of an issue in practice than you might think. Occasionally I have to make an exception for my bank or gmail. If you do have to make a few variations at least it's only two or three passwords you have to remember instead of a different one for every login.
gshulegaard 10y ago
Genuinely curious, but what do you think the severity is? Everything I know about it (this article included) places the Dropbox leak very low in my sense of severity.
- landr0id 10y ago
  The first time I saw the email I believed that Dropbox was taking it as a preventative measure because they thought they were breached -- not that they were breached. This information as hidden behind the link to more information in the email itself.
- achr2 10y ago
  The severity stems from the unfortunate fact that a password leak retroactively, and silently, destroys your security across all sites that use the same or a similar password. Even if you started using the longest, randomised, two-factor-authenticated password system last year, all those forgotten or seemingly unimportant accounts are suddenly exposed. Even when the exposed sites have minimal information or impact, minor information in aggregate adds up to a lot of danger for escalation and social engineering. Now consider that there are huge swaths of people with the same password that they've use for email, banking, medicare, and everything else. A proper response from Dropbox would be to explicitly and loudly inform every leaked email address (not just their current users) that they need to immediately change every password across any and all sites that might use the same leaked credentials. Furthermore, Dropbox should set up a secure site with a unique link per email address that allows a user to key-in and check their memory against the exposed hash. I know that I have changed my password for Dropbox at least twice since 2012, but in 2012 I might have used an insecure password. Allowing me to figure it out before a nefarious party would allow me to better judge the potential personal impact.
  - tempestn 10y ago
    That's true if your actual password is leaked, but as described in this post, it is very unlikely that actual passwords could be retrieved. Still a non-zero risk, but I could see a case that the severity of that risk is low. The significantly greater issue imo is the leaking of email addresses and ensuing spam.

by achr2 10y ago

Swizec 10y ago

Non tech savvy? Everyone does this. It's practical. Sure most of us have a few passwords we reuse, but I know less than 5 people with truly unique passwords.

ksenzee 10y ago
No, lots of people use password managers. You should try one.
- simonswords82 10y ago
  I tried lastpass and it's been nothing but a pain in the arse. I still use it but I frickin' hate it.
  - tedmiston 10y ago
    If you're on a Mac, 1Password is a monumentally better experience.
    - inferiorhuman 10y ago
      Works great until it doesn't (multiple user profiles in your browser, HTTP auth, non-browser based stuff like VPNs).
      - niteshade 10y ago
        Wouldn't multiple user profiles have their own extensions? If so, then just install the extension on that profile? IIRC 1Password was working on something related to that, so perhaps that has changed recently. HTTP auth not working is a bit annoying, but it's not a massive deal when you can CMD+ALT+\ and copy-paste it. Same deal with non-browser based stuff.
    - simonswords82 10y ago
      I am on a Mac - I'll check out 1Password thanks
    - Redoubts 10y ago
      Why not just use keychain?
      - tedmiston 10y ago
        Two of the most compelling reasons are cross-browser support and a better cross-device experience. For example, viewing/editing Keychain password on an iPhone requires burrowing into the Settings app, whereas 1Password has an excellent app and extension.
dsacco 10y ago
Considering the consequences of password breaches, it's decidedly impractical. Password managers make it very easy to have unique passwords for all websites. I don't even know any of my passwords.
- softawre 10y ago
  Except the one to your password manager :)
  - dsacco 10y ago
    Well, yes :)
  - BinaryIdiot 10y ago
    This scares the crap out of me. I have to remember this one, super long and complex password for my password manager. If I ever accidentally paste it somewhere else, type it in somewhere or somehow it's leaked from the password manager then I am completely screwed. This one, tiny thing can completely turn my life upside down. For sites that require security questions those are easy to game so the only way to be secure is making up answers. So I wouldn't even be able to reset a large amount of very important passwords! I wish we had a better alternative to passwords. Something that's actually good, solid, can't lose or forget. I get the feeling we won't have that until we can start implanting chips in ourselves.
    - tdkl 10y ago
      You just immediately change the master password and delete previous versions of the database file ?
      - BinaryIdiot 10y ago
        Not really. If someone gets into someone else's password manager they can easily get a copy of all usernames and passwords and, if they're quick enough, they can start resetting them / closing them / committing fraud. So yeah change the password and delete previous versions is a good first step but everything else has already leaked to who knows where.
duaneb 10y ago
I'd argue with a password manager it's more pragmatic to have a different password everywhere. I know two passwords and use my manager for everything.
em3rgent0rdr 10y ago
Anyway, tech-savvy folk are more likely to setup their own file-sync server. It is the non-tech-savvy people who are the primary users of dropbox.
- hughw 10y ago
  Not many tech-savvy people have time to set up and maintain a personal file sync service that works across their laptops, phones, and tablets.
  - corobo 10y ago
    Second bit of data for that claim. I use dropbox because I can't be waffled to set up my own dropbox nor do I have the free time even if I did want to.
pault 10y ago
Use an algorithmic password. Pick some easy to remember keyword, then work some of the letters of the website into the password so each site is unique. For example, your seed could be "horse", and your gmail password would be something like "hgomrasiel". I've been doing this for ten years and haven't forgotten a password yet. :)
- chaz6 10y ago
  I would like to do this, and I thought about using an algorithm that uses the domain name as the seed, however different sites have different password policies, and expiration times which would make this very difficult to manage in practice. I wish all sites support things like OpenID so I can have one central place to sign in with 3-factor authentication.
  - pault 10y ago
    This comes up sometimes but I've found it to be less of an issue in practice than you might think. Occasionally I have to make an exception for my bank or gmail. If you do have to make a few variations at least it's only two or three passwords you have to remember instead of a different one for every login.

gshulegaard 10y ago

Genuinely curious, but what do you think the severity is? Everything I know about it (this article included) places the Dropbox leak very low in my sense of severity.

landr0id 10y ago
The first time I saw the email I believed that Dropbox was taking it as a preventative measure because they thought they were breached -- not that they were breached. This information as hidden behind the link to more information in the email itself.
achr2 10y ago
The severity stems from the unfortunate fact that a password leak retroactively, and silently, destroys your security across all sites that use the same or a similar password. Even if you started using the longest, randomised, two-factor-authenticated password system last year, all those forgotten or seemingly unimportant accounts are suddenly exposed. Even when the exposed sites have minimal information or impact, minor information in aggregate adds up to a lot of danger for escalation and social engineering. Now consider that there are huge swaths of people with the same password that they've use for email, banking, medicare, and everything else. A proper response from Dropbox would be to explicitly and loudly inform every leaked email address (not just their current users) that they need to immediately change every password across any and all sites that might use the same leaked credentials. Furthermore, Dropbox should set up a secure site with a unique link per email address that allows a user to key-in and check their memory against the exposed hash. I know that I have changed my password for Dropbox at least twice since 2012, but in 2012 I might have used an insecure password. Allowing me to figure it out before a nefarious party would allow me to better judge the potential personal impact.
- tempestn 10y ago
  That's true if your actual password is leaked, but as described in this post, it is very unlikely that actual passwords could be retrieved. Still a non-zero risk, but I could see a case that the severity of that risk is low. The significantly greater issue imo is the leaking of email addresses and ensuing spam.