3 ms·
The blog post mentions that they ended all logged in sessions, but did they also rollback any new sync settings set from the start of the incident to when they
by georgemcbay 15y ago
The blog post mentions that they ended all logged in sessions, but did they also rollback any new sync settings set from the start of the incident to when they did their cleanup? eg:
User Joe's account is logged into by attacker Tom. Tom sets his computer as one of Joe's "My Computers". Does what they did to clean up the problem invalidate this or does Joe have to log into his account, look at his list of "My Computers" and remove the ones he doesn't recognize manually to stop Tom's system from automatically syncing all his stuff until he does finally notice (which is likely never for most users, I'd assume)?
- jerrya 15y agoIIRC from the last dropbox security fiasco, they also have to revoke the magic cookies that permit access without a password.
- jdludlow 15y agoGood point. Probably worth checking your own sharing and connected device settings. == Connected Computers and Devices https://www.dropbox.com/account#manage https://www.dropbox.com/account#manage == Sharing https://www.dropbox.com/share https://www.dropbox.com/share
- CGamesPlay 15y agoI'm not affiliated with DropBox or familiar with the way their systems work internally, but it seems pretty likely to me that the "magic files that let you log in without a password" are what DropBox calls "sessions", since this is the only form of access control you have after a password. So yes, they did roll these back.