4 ms·

I'm sorry, but good. When you respond to such a serious issue with anything less than an immediate email announcement to your entire userbase, and especially if

I'm sorry, but good. When you respond to such a serious issue with anything less than an immediate email announcement to your entire userbase, and especially if your eventual announcement is an unapologetic, obscure blog post stating something like "that wasn't supposed to happen"/"that wasn't okay", you show that you care very little about the integrity and safety of your users' data.

breck 15y ago
I think in this case the critical issue was that they needed to focus 100% of their efforts on preventing the damage to those <100 users who's accounts were accessed. Some person out there could now be inflicting serious harm on these <100 people. I'm really hoping Dropbox is working with the authorities to catch him or her and minimize the potential damage. I emailed Dropbox asking if my account was accessed and they replied quickly saying no it wasn't. I think that's a perfectly good response. A mistake was made, and 1 person made a terrible decision to take advantage of it. I hope we can all rally around Dropbox and cut them some slack so they can do all they can for these <100 users who should have huge concerns. When they've resolved the crisis, then if you want to complain about them it'd be the time to do so. Right now I just hope they are doing everything they can for the seriously affected users, because if I was one of those users that's what I would want.
- pavel_lishin 15y ago
  They can't multi-task, and send one PR guy out to send a batch of e-mails informing their users what happened? Literally everyone in the company was chasing down this one miscreant?
  - breck 15y ago
    Think of how many customers would call and email them if they did a blast email. 1 million maybe? It would be a self inflicted ddos.
sorbus 15y ago
Everyone who was affected by the bug was notified by email, and Dropbox's CEO even gave them his phone number so that they could contact him. As I see it, that's the proper response to issues like this: informing everyone who was affected, and not panicking all the unaffected users.
- thirsteh 15y ago
  I don't believe they can pinpoint "the affected users" (supposedly below 100) with such accuracy. It's not responsible to assume nobody else logged in from another location just because only one person logged into 100+ accounts. It would have been easy to announce without panicking the existing users. By not announcing it at all, and trying to stay below the radar, you incite everyone who's unaffected and reads the news--or, at least, they did me. It's a cheap business move, not "the integrity of your data is our first priority".
  - sorbus 15y ago
    This happened on a sunday originally, right? Hence a small number of users logging in to the website. Pinpointing affected users could be as simple as finding the small number of accounts which were logged into from new IP addresses. Alternatively, perhaps the auth server was logging failed attempts, even though the bug resulted in failed attempts being treated as successful attempts. That would make it ridiculously trivial to find all of the accounts compromised - any account accessed with an incorrect password from a new IP address. The number of attackers doesn't matter. Admittedly, I don't work for Dropbox, and am not aware of the details of how they identifying affected users. I'm just pointing out that it would be very easy to identify affected users with high accuracy and almost no chance of false negatives.
    - thirsteh 15y ago
      What is your definition of small? You don't think there were MANY accounts that logged in from new locations in that time frame? Think wireless networks... I simply refuse to believe that with such a gigantic service they could determine that only X and Y were compromised by "one person" so accurately and so quickly--especially considering they haven't even implemented a build/deploy-time test suite that, among many other things, asserts that something like the auth system works actually works. Your suggestion is pure speculation like you say, and, really, any application that logs something like "invalid auth" usually(!) immediately aborts the session (since that's the logical thing to do); it doesn't continue it...

breck 15y ago

I think in this case the critical issue was that they needed to focus 100% of their efforts on preventing the damage to those <100 users who's accounts were accessed. Some person out there could now be inflicting serious harm on these <100 people. I'm really hoping Dropbox is working with the authorities to catch him or her and minimize the potential damage. I emailed Dropbox asking if my account was accessed and they replied quickly saying no it wasn't. I think that's a perfectly good response. A mistake was made, and 1 person made a terrible decision to take advantage of it. I hope we can all rally around Dropbox and cut them some slack so they can do all they can for these <100 users who should have huge concerns. When they've resolved the crisis, then if you want to complain about them it'd be the time to do so. Right now I just hope they are doing everything they can for the seriously affected users, because if I was one of those users that's what I would want.

pavel_lishin 15y ago
They can't multi-task, and send one PR guy out to send a batch of e-mails informing their users what happened? Literally everyone in the company was chasing down this one miscreant?
- breck 15y ago
  Think of how many customers would call and email them if they did a blast email. 1 million maybe? It would be a self inflicted ddos.

sorbus 15y ago

Everyone who was affected by the bug was notified by email, and Dropbox's CEO even gave them his phone number so that they could contact him. As I see it, that's the proper response to issues like this: informing everyone who was affected, and not panicking all the unaffected users.

thirsteh 15y ago
I don't believe they can pinpoint "the affected users" (supposedly below 100) with such accuracy. It's not responsible to assume nobody else logged in from another location just because only one person logged into 100+ accounts. It would have been easy to announce without panicking the existing users. By not announcing it at all, and trying to stay below the radar, you incite everyone who's unaffected and reads the news--or, at least, they did me. It's a cheap business move, not "the integrity of your data is our first priority".
- sorbus 15y ago
  This happened on a sunday originally, right? Hence a small number of users logging in to the website. Pinpointing affected users could be as simple as finding the small number of accounts which were logged into from new IP addresses. Alternatively, perhaps the auth server was logging failed attempts, even though the bug resulted in failed attempts being treated as successful attempts. That would make it ridiculously trivial to find all of the accounts compromised - any account accessed with an incorrect password from a new IP address. The number of attackers doesn't matter. Admittedly, I don't work for Dropbox, and am not aware of the details of how they identifying affected users. I'm just pointing out that it would be very easy to identify affected users with high accuracy and almost no chance of false negatives.
  - thirsteh 15y ago
    What is your definition of small? You don't think there were MANY accounts that logged in from new locations in that time frame? Think wireless networks... I simply refuse to believe that with such a gigantic service they could determine that only X and Y were compromised by "one person" so accurately and so quickly--especially considering they haven't even implemented a build/deploy-time test suite that, among many other things, asserts that something like the auth system works actually works. Your suggestion is pure speculation like you say, and, really, any application that logs something like "invalid auth" usually(!) immediately aborts the session (since that's the logical thing to do); it doesn't continue it...