4 ms·
Dropbox Breach: Fewer Than 100 Accounts Affected, One Person Actively Exploited
- deleted 15y ago[deleted]
- mgl 15y agoNicely handled by Drew, congrats. From PR perspective the only thing missing is a statement on how they are going to prevent such situations from happening in the future.
- mtogo 15y agoDrew should really be handling their PR. I'm not sure why they still let Arash post anything publicly.
- deleted 15y ago[deleted]
- ghurlman 15y agoI still maintain they should send an "all clear" email to people that weren't accessed, just for peace of mind.
- jerrya 15y agoI haven't even received my notice that there was a security breach to begin with. I wonder if Dropbox lists on its balance sheet a teflon shield, or jobsian field of distortion generator....
- chernevik 15y agoApple's been disclosing theirs for years -- required to by GAAP -- but the thing prevents people from noticing it. These only appear when notice of them is helpful, say in court cases and such. Sort of like using an eclipse to see a star through a gravitational lens. And even then you can't remember the case, or its role in the reasoning, just that Apple was totally not at fault.
- jerrya 15y agoI think the title is misleading.... One person was responsible for exploiting up to 100 people.
- edwardy20 15y agoYeah it should be "One Person Actively Exploited up to 100 People".
- VB6_Foreverr 15y agoWe use truecrypt to secure business data on dropbox. It works OK but is not ideal. Problems occur if say I leave the container file mounted on my computer and someone else then mounts it on another. While a file is mounted no syncing can occur. The mere act of mounting and then dismounting a truecrypt file means that as far as dropbox is concerned the file has changed and requires syncing. So if user A mounts, then user B mounts before A dismounts then a copy of the truecrypt file ends up being added to the dropbox folder on each computer. Whatever the solution is, I think that this security failure demands that user controlled encryption has to be part of it.
- deleted 15y ago[deleted]
- Havoc 15y agoThe part of one individual doing all the accessing can't be right. The dude who reported it (on hn or reddit not sure) said he had his friend double check it.
- colonelxc 15y agoThey may just be counting those who were actively exploited, and excluded the cases where the guy and his friend were checking a few accounts. Since they reported it, it would be fairly easy to isolate their activities from other accesses.
- VMG 15y agoStill, they should be more precise in their language.
- jasongullickson 15y agoYes it was a nicely worded email but without a file-level log of what was accessed and when it's hard to know if you need to worry about this or not.
- veidr 15y agoThey really should have referenced in the email, but Dropbox does already have a file-level timestamped activity log that you can access for your account anytime: https://www.dropbox.com/events https://www.dropbox.com/events EDIT: Oops, my bad: this log only tracks add, edit, move, delete. It doesn't show what files have been viewed/downloaded. Sorry for the noise.
- jasongullickson 15y agoTrue however this doesn't appear to track "reads" (unless I'm overlooking something?).
- sorbus 15y agoNote that the email mentions that some users (well, at least the user who disclosed the email) did not have any of their files accessed: "our records do not indicate that any files were viewed or downloaded." Presumably, they're doing something different for users who did have their files accessed, or at least if one of those users specifically requested that information they would disclose it. If you're saying that Dropbox should include an access log for their web interface, then I fully agree (even if it's buried in the interface, with a giant "experimental" warning, it would still be useful).
- rdl 15y agoThis was a great letter, and Drew handled this perfectly. I am impressed.