3 ms·
I'm not sure I totally understand. Is he saying that the users who were already logged in during the code update were the ones who had access to any account? Or
by famousactress 15y ago
I'm not sure I totally understand. Is he saying that the users who were already logged in during the code update were the ones who had access to any account? Or is he wrangling words and letting us know that < 1% of Dropbox users had active web sessions at the time?
I understand the challenge that the Dropbox team finds themselves in here, but I'd very much like more details as to exactly what happened and what was possible for 4+ hours. I'm less interested in they're eventual report of the bad stuff they think did or didn't happen during that time.
- georgemcbay 15y agoHe's saying that for any account to have been potentially compromised due to this bug it would have had to occur during the ~4 hour window the bug was active. During that window less than 1% of all dropbox users logged in, so that puts a cap on how many users could potentially have been compromised. Of course, of that "less than 1%" most were probably valid logins, so that 1% doesn't represent only compromised accounts but rather a ceiling on how many could possibly have been compromised.
- famousactress 15y agoThanks.. That makes perfect sense. That said, I can't help but feeling misdirected. I mean, obviously the cap on the number of compromised accounts is relevant, but I think more relevant is the fact that 100% of the accounts were completely insecure for hours. Misdirected, because as a user I don't care at all how many accounts were actually compromised. This isn't a no-harm-no-foul incident. It's an enormous breach of trust that causes me to completely rethink what I'd be willing to do with their service.
- deleted 15y ago[deleted]