3 ms·
From the diagram, Dropbox stores no passwords: it stores an encrypted hash (hasing in two steps, SHA512 and then "bcrypt") of the password. I.e. stored = AES256
by faragon 10y ago
From the diagram, Dropbox stores no passwords: it stores an encrypted hash (hasing in two steps, SHA512 and then "bcrypt") of the password. I.e. stored = AES256(bcrypt(SHA512(password), per_user_salt, 10), global_key).
I would like to know if "salted-bcrypt"+SHA512 hashing is really safer than using just SHA512 (e.g. because of the risk of making locating hash collisions easier, etc.).
- cstrat 10y agoI posted a separate comment, but will post here again... Dropbox do store one password AFAIK. It appears that they store OSX users administrator password... I am keen to see if they address this somewhere. See discussion: https://news.ycombinator.com/item?id=12457067 https://news.ycombinator.com/item?id=12457067
- angry_octet 10y agoNo, they use the admin access they obtain from you to modify the system so they can obtain admin access again in the future. They do not ever have your admin password.