3 ms·

Hashed passwords? Surely they mean hashed and salted passwords. Right? Right???

• rvnx 3y ago
  They were using SHA1, then they migrated. 68 million accounts dumped: https://www.theguardian.com/technology/2016/aug/31/dropbox-hack-passwords-68m-data-breach https://www.theguardian.com/technology/2016/aug/31/dropbox-h... https://www.troyhunt.com/the-dropbox-hack-is-real/ https://www.troyhunt.com/the-dropbox-hack-is-real/ now they first hash the password using SHA512 (with a per-account salt) then they hash the password with bcrypt (with the default strength) then they encrypt the password with a key that the application server runs with, but that is not stored in the database. So yes, hashed and salted.
  • SoftTalker 3y ago
    They encrypt the salted password hash?
  • dkyc 3y ago
    This hack seems to affect the Dropbox Sign application, which is based on HelloSign which they acquired a few years ago. It’s still running on the hellosign.com domain and seems mostly separate, so it wouldn’t surprise me if they also store passwords differently.
  • xrisk 3y ago
    That… seems excessive. Is it just security theater or actually useful somehow?
    • ottaviani 3y ago
      [dead]
    • zsims 3y ago
      Useful because you can support existing passwords without requiring everyone to login or reset their password. Still has flaws though, like password shucking.