6 ms·

Dropbox confirms it got hacked, will offer two-factor authentication

129 points by palebluedot 14y ago

damncabbage 14y ago
Most worrying quote for me: Dropbox today said a stolen password was "used to access an employee Dropbox account containing a project document with user email addresses." (What else is being left around in data dumps?)
- LogicX 14y ago
  There's no mention of how many users were in that document. I've had a Dropbox account for many years with a Dropbox specific email address and I did not receive spam, so it must not have been everyone.
  - yen223 14y ago
    It appears that the attacker had a list of stolen emails and passwords from other compromised sites, so your Dropbox account would probably be safe.
sillysaurus 14y ago
Dropbox did not get hacked. One of their employees used the same password on multiple other sites, and one of those got hacked. This is awful journalism.
- yelloweye 14y ago
  Really? Why an employee is keeping customers email address in his/ her dropbox account. What kind of internal control Dropbox is employing? There is an limit to dropbox fanboism.
- jasonzemos 14y ago
  Security is fungible. You're applying some subjective standard that divides what constitutes a hack and what doesn't. If I had to guess, you wouldn't treat a buffer overflow where some code was executed the same way. This is arbitrary. Considering a dropbox employee, corporate information, and internal security practices are on the line here: I think the author made the fair, ethical call.
  - sillysaurus 14y ago
    No, the article is flat-out wrong. "Dropbox got hacked" means their system security is breachable by a malicious attacker. This is simply not true.
    - yen223 14y ago
      I would think that if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts, that would constitute a security breach.
      - sillysaurus 14y ago
        if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts ... That didn't happen. The employee account merely contained a list of email addresses.
        aprendo 14y ago
        User account data. Not as bad. Still awful. Hacked is a perfectly valid term to use. Dropbox allowed their employees to have user data just lying around and their policy on how employees have to treat that data seems either ineffective or non-existant. I don’t really care that a human and not a piece of software written by a human was the point of failure here. Hack seems like the perfectly applicable term.
        arrrg 14y ago
        That’s not really a response, is it? User account data could be accessed – because Dropbox was unable to protect your data. That’s not quite as awful a access to user account but it’s still awful.
- piggity 14y ago
  A few years ago... RSA was hacked and the attackers could then get access to US military contractor internal data. ... LinkedIn was hacked and the attackers could then get access to DropBox internal data. Would the military contractors claim that they weren't hacked?
  - drivebyacct2 14y ago
    Given that the RSA intrusion was known and the government didn't take steps to change passwords, sure. In this case, it's perfectly fair to say the Dropbox employee stupidly allowed their email to be hacked. But making it sound as if Dropbox's security was compromised is misleading and inaccurate IMO.
- tripzilch 14y ago
  Security is as strong as your weakest link. If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference. This is the same silliness that makes people claim that social engineering isn't actually a security breach "oh they just phoned up the front desk and convinced them to be granted access, who would fall for that, that's not hacking!", yeah, no, someone just got 0wned.
tomcorrigan 14y ago
Meh. This has already been posted: http://news.ycombinator.com/item?id=4320429 http://news.ycombinator.com/item?id=4320429 Also, kindly avoid the linkbait title, dropbox did not get hacked, some of its users' account credentials were compromised on other sites.
- Maxious 14y ago
  Just to be clear one of those users was a Dropbox employee who had a document containing user details including but not limited to email addresses (some that had only been used for Dropbox). These details were then provided to spammers
- jarek 14y ago
  > Also, kindly avoid the linkbait title The title of this submission matches the title of the article, matching recent HN policy. Users objecting to the phrasing may wish to flag the submission instead.
  - tomcorrigan 14y ago
    I'm just going to quote the HN guideline back to you. > please use the original title, unless it is misleading or linkbait.
    - jarek 14y ago
      Yep, the guideline does say that. That is why I said recent policy. There have been several recent instances of submission title being edited to match the article linked, in some cases when that title was misleading or provided minimal context. Some examples here: http://news.ycombinator.com/item?id=4102013 http://news.ycombinator.com/item?id=4102013
mgurlitz 14y ago
> It turns out a Dropbox employee’s account was hacked, allowing access to user e-mail addresses. This is misleading. > Some Dropbox customer accounts were hacked too, but this was apparently an unrelated matter. Unrelated how? What I read was: "Our investigation found that usernames and passwords recently stolen from other websites... A stolen password was also used to access an employee Dropbox account" This article dangerously leaves the impression that an intrusion was made into Dropbox's system to access the employee's account, and possibly an admin interface. In reality Dropbox let a spammer with a valid email and password look at someone's files.
- deliciouscoffee 14y ago
  An employee account was compromised and privileged information (in this case user email addresses) was accessed. The attacker exploited a flaw in dropbox's password policy / authentication system to access the information. Dropbox is modifying their systems and policies to prevent this sort of attack in the future. All that together certainly adds up to an intrusion and is well within the definition of a "hack".
  - sillysaurus 14y ago
    No, a hack means that any malicious attacker (you, me, your mom, etc) could exploit ("hack") a flaw in their system security in order to gain access. This is not the case here.
  - unreal37 14y ago
    Yeah this wasn't a "hack". No more than using an authentic ATM bank card with a valid PIN number is a "bank robbery". Sounds like employee error - using the same password for their dropbox account as on their LinkedIn account.
  - tlrobinson 14y ago
    "a flaw in dropbox's password policy / authentication system to access the information" What flaw? It sounds like a Dropbox employee was simply reusing a password stolen on another site.
theprodigy 14y ago
I believe your dropbox needs to be secure as your email account because it deals with storing your personal data.So offering 2 factor authentication is a step in the right direction, like what gmail has. Other than that dropbox can't do much about people using the same passwords for different sites or social engineering attacks. You can educate and warn people about it, but it's ultimately up to the user to follow through.
FaceKicker 14y ago
I wish websites with user accounts would offer the option to "login via email" - as in you'd type in your username (or preferably your email) and maybe a captcha and then you'd login by clicking a link it sends via email afterwards. Ideally having a password associated with the account at all would be optional. I have a Gmail tab opened just about 100% of the time I'm on the computer, so this would be very convenient for me as an alternative to having to remember passwords for sites that I visit once a month or less (and end up having to get a "password reset" link via email every time I log in anyway), and then I'd only have to keep my Gmail account secure (which I do via 2 factor).
- yen223 14y ago
  In this case it wouldn't have helped, because the intruder apparently had access to a Dropbox employee's email account. EDIT: Disregard what I said, apparently the attacker had access to the Dropbox employee's Dropbox account.
  - FaceKicker 14y ago
    To be honest I was mostly using the comments section for this link as a soapbox, I realize the idea isn't too relevant to this particular case with Dropbox, as no passwords are known to have been revealed. Sorry. Though, I do think it would often mitigate the damage from this type of security breach that it seems like we've seen so much of from big name tech companies lately. I'd guess that a majority of accounts created on the internet are pretty unimportant to the account creator, and with how often passwords are reused indiscriminately, the worst effect of these password leaks is often not the unauthorized access to all those accounts on the hacked site but rather the usernames and passwords themselves - which are very often reused for bank, email, etc. accounts. With my proposal, anyone who opted not to have a password wouldn't be vulnerable to that.
  - tlrobinson 14y ago
    Where do you see anything about the Dropbox employee's email account being compromised?
DigitalSea 14y ago
Is it just me or has there been a lot of security mishaps like this for various high-profile services? LinkedIn was a victim on a much larger extent not to long ago. This is becoming ridiculous.
- unreal37 14y ago
  This isn't on the same scale. Some user email addresses were in a spreadsheet, and the employee's password was compromised. I bet every single day someone's Gmail gets "hacked" if that's the standard for that.
  - DigitalSea 14y ago
    The point is it shouldn't occur on any scale. Even small scale security exploits can turn into much bigger ones further down the track. For all we know, we've yet to see the full consequences of this attack it could be revealed that it's much more than an a spreadsheet of email addresses. The very fact Dropbox made everyone change their password is proof enough that even Dropbox aren't sure what hackers have taken or had access too..
majorapps 14y ago
Very few startups attempt space travel. This is the evolution of the Web. Only the giants will be able to build scalable, secure Web services. Discuss.
yelloweye 14y ago
Let us face it. There is nothing secure about Public online services. It is just a huge honeypot waiting to be hacked.
lgeek 14y ago
Maybe they should offer client side encryption. You know, the kind that's not reversible on their side of things.
- Danieru 14y ago
  Client side encryption would stop Dropbox from deduplicating the data. Very few people rip their own CDs. Instead they buy them from a digital store or pirate them. In either case the mp3 will not be unique. If you look in the average users home directory you'll find a few megabytes of word documents, a few hundred megabytes of family photos and maybe their music collection. If we assume that the set of files users sync is similar to the set of files in their home directory then it is not a stretch to conclude that Dropbox deals with lots of music. Dropbox cannot do anything about the documents or family photos but they can save considerable bandwidth and disk space by deduplicating the music, or any other common media. Since dropbox's biggest input cost is storage I could well see client side encryption having a consider effect on their profitability.
  - rdl 14y ago
    You could construct a de-duplicated system with client side encryption by building an index pre-encryption. There is some leakage of information about what files exist, but not the contents of those files, and IMO the "files which are shared widely among Dropbox accounts" are NOT the ones people care most about keeping encrypted... There are several systems with client side encryption, some of which also have de-duplication, and at least one of which has interesting crypto (bitcasa). This is all unrelated to the authentication problem with dropbox today, though.
  - MichaelGG 14y ago
    Due to exaggerated copyright concerns, Dropbox no longer dedupes across customers, last I checked. People were using dedupe to "instantly send" files (a project called Dropship). Dropbox felt that made them too liable for copyright infringement and nixed the feature.
- emmett 14y ago
  1) What about this issue would have been helped by client-side encryption? A valid username and password was used to access dropbox information, so it would have gone right through client-side encryption. 2) Do you not enjoy features like the web interface and public links? Those are one of my favorite parts of dropbox and they wouldn't work with client-side encryption.
jpalomaki 14y ago
Very happy to hear they are planning to start offering two-factoring authentication. Hopefully something that works with Google Authenticator. For client side encryption I have good experiences from BoxCryptor on Windows.
- buro9 14y ago
  I really hope that Dropbox use Google Authenticator. The last thing I want is double the number of apps on my phone as every single app has another 2-factor auth app to ship. Just add yourself to Google Authenticator and be done with it. It doesn't require a Google account, you can use Google Authenticator as the generator of the 2-factor auth code and that's all. LastPass uses Google Authenticator for 2-factor, and it works well. One of the problems I've found with Dropbox is that I tend to use a shorter and easier to type password because I enter it on my phone in addition to my desktop. Good passwords are great when you have a password manager, but in the app you're stuck with having to type it in. So my Dropbox password is weaker than I'd want just because apps mean I can't use a password manager. 2-factor can't come soon enough for me. On a related note, 2-factor is one of the weaknesses I want addressed. The other one I'll bang on about is client-side encryption. If it's possible at all for someone to access their systems I still want to feel sure that someone can't access my files. It's not that I limit my use of Dropbox, but I use it differently. That 1GB file in my account... that's a Truecrypt volume. The other files are just less sensitive.
  - tallanvor 14y ago
    How often do you have to log into your dropbox account? I hardly ever have to log into the website, and you don't have to log in every time on your phone.
    - buro9 14y ago
      I do client work and frequently find myself onsite where I can't connect my computer or phone to the network yet can use a computer on their network to access the web. So, a fair amount.
  - deleted 14y ago
timkeller 14y ago
The most annoying part is the disingenuous email we all received tonight. Recently, passwords have been stolen from some internet services. We've reset your password. I'd have been shocked, but ultimately more respectful of: We've had a security violation. You can read about it here. Your account wasn't affected, but we're resetting everyone's password just in case. So sorry about this.
paulsilver 14y ago
It disappoints me that a Dropbox employee might be using the same password for a work account and anything not work related. It's bad enough that they might re-use passwords internally, but I find that understandable. However, using a work e-mail and the password you use at work on someone else's system was stupid. You can have faith in your own security measures, but not anyone else's. If you're going to re-use passwords, at least have a work one and an everything else one.
trekkin 14y ago
That's why client-side encryption is useful, regardless of what some "security researchers" self-servingly say.
chmars 14y ago
IMHO confirms this incident the value of having an individual mail address for each site, service etc. Gmail has allowed for such individual mail addresses for years: username+loremipsum@gmail.com Example: johndoe+dropboxcom@gmail.com Mails addressed to johndoe+dropboxcom@gmail.com will be delivered to johndoe@gmail.com. They are easy to identify, filter etc.
- AkThhhpppt 14y ago
  That's not just GMail, that's all compliant email handlers; it's part of the RFC. Unfortunately, it's not guaranteed that the site you're signing up to can handle that address format - Facebook doesn't...
  - chmars 14y ago
    Thanks, I had no idea of this RFC part.
  - mitchellhislop 14y ago
    The new outlook.com also does not respect the RFC in this case, which I thought was especially funny.
  - mgurlitz 14y ago
    While the RFC mandates the ability to send and receive email from user+detail@example.org it doesn't require that it go to user@example.org. It's an extension to the email standard, and you could have labels in another form if you wanted to, e.g. inbox0-user@example.org (http://tools.ietf.org/html/rfc5233 http://tools.ietf.org/html/rfc5233)
  - nollidge 14y ago
    Right, but GMail not only allows +, it treats it special. That's not in the RFC, as far as I can tell.
rocky1138 14y ago
To increase security you can enable "email me when a new computer or app is linked to my account" in the account settings. It's not much, but at least you'll be notified when someone syncs their computer with your dropbox or adds your dropbox to their phone.
executive 14y ago
Not surprising. Remember, we're talking about a service that at times lets anyone login to another user's account without a password.

129 points by palebluedot 14y ago

Most worrying quote for me: Dropbox today said a stolen password was "used to access an employee Dropbox account containing a project document with user email addresses." (What else is being left around in data dumps?)

LogicX 14y ago
There's no mention of how many users were in that document. I've had a Dropbox account for many years with a Dropbox specific email address and I did not receive spam, so it must not have been everyone.
- yen223 14y ago
  It appears that the attacker had a list of stolen emails and passwords from other compromised sites, so your Dropbox account would probably be safe.

sillysaurus 14y ago

Dropbox did not get hacked. One of their employees used the same password on multiple other sites, and one of those got hacked. This is awful journalism.

yelloweye 14y ago
Really? Why an employee is keeping customers email address in his/ her dropbox account. What kind of internal control Dropbox is employing? There is an limit to dropbox fanboism.
jasonzemos 14y ago
Security is fungible. You're applying some subjective standard that divides what constitutes a hack and what doesn't. If I had to guess, you wouldn't treat a buffer overflow where some code was executed the same way. This is arbitrary. Considering a dropbox employee, corporate information, and internal security practices are on the line here: I think the author made the fair, ethical call.
- sillysaurus 14y ago
  No, the article is flat-out wrong. "Dropbox got hacked" means their system security is breachable by a malicious attacker. This is simply not true.
  - yen223 14y ago
    I would think that if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts, that would constitute a security breach.
    - sillysaurus 14y ago
      if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts ... That didn't happen. The employee account merely contained a list of email addresses.
      - aprendo 14y ago
        User account data. Not as bad. Still awful. Hacked is a perfectly valid term to use. Dropbox allowed their employees to have user data just lying around and their policy on how employees have to treat that data seems either ineffective or non-existant. I don’t really care that a human and not a piece of software written by a human was the point of failure here. Hack seems like the perfectly applicable term.
      - arrrg 14y ago
        That’s not really a response, is it? User account data could be accessed – because Dropbox was unable to protect your data. That’s not quite as awful a access to user account but it’s still awful.
piggity 14y ago
A few years ago... RSA was hacked and the attackers could then get access to US military contractor internal data. ... LinkedIn was hacked and the attackers could then get access to DropBox internal data. Would the military contractors claim that they weren't hacked?
- drivebyacct2 14y ago
  Given that the RSA intrusion was known and the government didn't take steps to change passwords, sure. In this case, it's perfectly fair to say the Dropbox employee stupidly allowed their email to be hacked. But making it sound as if Dropbox's security was compromised is misleading and inaccurate IMO.
tripzilch 14y ago
Security is as strong as your weakest link. If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference. This is the same silliness that makes people claim that social engineering isn't actually a security breach "oh they just phoned up the front desk and convinced them to be granted access, who would fall for that, that's not hacking!", yeah, no, someone just got 0wned.

tomcorrigan 14y ago

Meh. This has already been posted: http://news.ycombinator.com/item?id=4320429 http://news.ycombinator.com/item?id=4320429 Also, kindly avoid the linkbait title, dropbox did not get hacked, some of its users' account credentials were compromised on other sites.

Maxious 14y ago
Just to be clear one of those users was a Dropbox employee who had a document containing user details including but not limited to email addresses (some that had only been used for Dropbox). These details were then provided to spammers
jarek 14y ago
> Also, kindly avoid the linkbait title The title of this submission matches the title of the article, matching recent HN policy. Users objecting to the phrasing may wish to flag the submission instead.
- tomcorrigan 14y ago
  I'm just going to quote the HN guideline back to you. > please use the original title, unless it is misleading or linkbait.
  - jarek 14y ago
    Yep, the guideline does say that. That is why I said recent policy. There have been several recent instances of submission title being edited to match the article linked, in some cases when that title was misleading or provided minimal context. Some examples here: http://news.ycombinator.com/item?id=4102013 http://news.ycombinator.com/item?id=4102013

mgurlitz 14y ago

> It turns out a Dropbox employee’s account was hacked, allowing access to user e-mail addresses. This is misleading. > Some Dropbox customer accounts were hacked too, but this was apparently an unrelated matter. Unrelated how? What I read was: "Our investigation found that usernames and passwords recently stolen from other websites... A stolen password was also used to access an employee Dropbox account" This article dangerously leaves the impression that an intrusion was made into Dropbox's system to access the employee's account, and possibly an admin interface. In reality Dropbox let a spammer with a valid email and password look at someone's files.

deliciouscoffee 14y ago
An employee account was compromised and privileged information (in this case user email addresses) was accessed. The attacker exploited a flaw in dropbox's password policy / authentication system to access the information. Dropbox is modifying their systems and policies to prevent this sort of attack in the future. All that together certainly adds up to an intrusion and is well within the definition of a "hack".
- sillysaurus 14y ago
  No, a hack means that any malicious attacker (you, me, your mom, etc) could exploit ("hack") a flaw in their system security in order to gain access. This is not the case here.
- unreal37 14y ago
  Yeah this wasn't a "hack". No more than using an authentic ATM bank card with a valid PIN number is a "bank robbery". Sounds like employee error - using the same password for their dropbox account as on their LinkedIn account.
- tlrobinson 14y ago
  "a flaw in dropbox's password policy / authentication system to access the information" What flaw? It sounds like a Dropbox employee was simply reusing a password stolen on another site.

theprodigy 14y ago

I believe your dropbox needs to be secure as your email account because it deals with storing your personal data.So offering 2 factor authentication is a step in the right direction, like what gmail has. Other than that dropbox can't do much about people using the same passwords for different sites or social engineering attacks. You can educate and warn people about it, but it's ultimately up to the user to follow through.

FaceKicker 14y ago

I wish websites with user accounts would offer the option to "login via email" - as in you'd type in your username (or preferably your email) and maybe a captcha and then you'd login by clicking a link it sends via email afterwards. Ideally having a password associated with the account at all would be optional. I have a Gmail tab opened just about 100% of the time I'm on the computer, so this would be very convenient for me as an alternative to having to remember passwords for sites that I visit once a month or less (and end up having to get a "password reset" link via email every time I log in anyway), and then I'd only have to keep my Gmail account secure (which I do via 2 factor).

yen223 14y ago
In this case it wouldn't have helped, because the intruder apparently had access to a Dropbox employee's email account. EDIT: Disregard what I said, apparently the attacker had access to the Dropbox employee's Dropbox account.
- FaceKicker 14y ago
  To be honest I was mostly using the comments section for this link as a soapbox, I realize the idea isn't too relevant to this particular case with Dropbox, as no passwords are known to have been revealed. Sorry. Though, I do think it would often mitigate the damage from this type of security breach that it seems like we've seen so much of from big name tech companies lately. I'd guess that a majority of accounts created on the internet are pretty unimportant to the account creator, and with how often passwords are reused indiscriminately, the worst effect of these password leaks is often not the unauthorized access to all those accounts on the hacked site but rather the usernames and passwords themselves - which are very often reused for bank, email, etc. accounts. With my proposal, anyone who opted not to have a password wouldn't be vulnerable to that.
- tlrobinson 14y ago
  Where do you see anything about the Dropbox employee's email account being compromised?

DigitalSea 14y ago

Is it just me or has there been a lot of security mishaps like this for various high-profile services? LinkedIn was a victim on a much larger extent not to long ago. This is becoming ridiculous.

unreal37 14y ago
This isn't on the same scale. Some user email addresses were in a spreadsheet, and the employee's password was compromised. I bet every single day someone's Gmail gets "hacked" if that's the standard for that.
- DigitalSea 14y ago
  The point is it shouldn't occur on any scale. Even small scale security exploits can turn into much bigger ones further down the track. For all we know, we've yet to see the full consequences of this attack it could be revealed that it's much more than an a spreadsheet of email addresses. The very fact Dropbox made everyone change their password is proof enough that even Dropbox aren't sure what hackers have taken or had access too..

majorapps 14y ago

Very few startups attempt space travel. This is the evolution of the Web. Only the giants will be able to build scalable, secure Web services. Discuss.

yelloweye 14y ago

Let us face it. There is nothing secure about Public online services. It is just a huge honeypot waiting to be hacked.

lgeek 14y ago

Maybe they should offer client side encryption. You know, the kind that's not reversible on their side of things.

Danieru 14y ago
Client side encryption would stop Dropbox from deduplicating the data. Very few people rip their own CDs. Instead they buy them from a digital store or pirate them. In either case the mp3 will not be unique. If you look in the average users home directory you'll find a few megabytes of word documents, a few hundred megabytes of family photos and maybe their music collection. If we assume that the set of files users sync is similar to the set of files in their home directory then it is not a stretch to conclude that Dropbox deals with lots of music. Dropbox cannot do anything about the documents or family photos but they can save considerable bandwidth and disk space by deduplicating the music, or any other common media. Since dropbox's biggest input cost is storage I could well see client side encryption having a consider effect on their profitability.
- rdl 14y ago
  You could construct a de-duplicated system with client side encryption by building an index pre-encryption. There is some leakage of information about what files exist, but not the contents of those files, and IMO the "files which are shared widely among Dropbox accounts" are NOT the ones people care most about keeping encrypted... There are several systems with client side encryption, some of which also have de-duplication, and at least one of which has interesting crypto (bitcasa). This is all unrelated to the authentication problem with dropbox today, though.
- MichaelGG 14y ago
  Due to exaggerated copyright concerns, Dropbox no longer dedupes across customers, last I checked. People were using dedupe to "instantly send" files (a project called Dropship). Dropbox felt that made them too liable for copyright infringement and nixed the feature.
emmett 14y ago
1) What about this issue would have been helped by client-side encryption? A valid username and password was used to access dropbox information, so it would have gone right through client-side encryption. 2) Do you not enjoy features like the web interface and public links? Those are one of my favorite parts of dropbox and they wouldn't work with client-side encryption.

jpalomaki 14y ago

Very happy to hear they are planning to start offering two-factoring authentication. Hopefully something that works with Google Authenticator. For client side encryption I have good experiences from BoxCryptor on Windows.

buro9 14y ago
I really hope that Dropbox use Google Authenticator. The last thing I want is double the number of apps on my phone as every single app has another 2-factor auth app to ship. Just add yourself to Google Authenticator and be done with it. It doesn't require a Google account, you can use Google Authenticator as the generator of the 2-factor auth code and that's all. LastPass uses Google Authenticator for 2-factor, and it works well. One of the problems I've found with Dropbox is that I tend to use a shorter and easier to type password because I enter it on my phone in addition to my desktop. Good passwords are great when you have a password manager, but in the app you're stuck with having to type it in. So my Dropbox password is weaker than I'd want just because apps mean I can't use a password manager. 2-factor can't come soon enough for me. On a related note, 2-factor is one of the weaknesses I want addressed. The other one I'll bang on about is client-side encryption. If it's possible at all for someone to access their systems I still want to feel sure that someone can't access my files. It's not that I limit my use of Dropbox, but I use it differently. That 1GB file in my account... that's a Truecrypt volume. The other files are just less sensitive.
- tallanvor 14y ago
  How often do you have to log into your dropbox account? I hardly ever have to log into the website, and you don't have to log in every time on your phone.
  - buro9 14y ago
    I do client work and frequently find myself onsite where I can't connect my computer or phone to the network yet can use a computer on their network to access the web. So, a fair amount.
- deleted 14y ago

timkeller 14y ago

The most annoying part is the disingenuous email we all received tonight. Recently, passwords have been stolen from some internet services. We've reset your password. I'd have been shocked, but ultimately more respectful of: We've had a security violation. You can read about it here. Your account wasn't affected, but we're resetting everyone's password just in case. So sorry about this.

paulsilver 14y ago

It disappoints me that a Dropbox employee might be using the same password for a work account and anything not work related. It's bad enough that they might re-use passwords internally, but I find that understandable. However, using a work e-mail and the password you use at work on someone else's system was stupid. You can have faith in your own security measures, but not anyone else's. If you're going to re-use passwords, at least have a work one and an everything else one.

trekkin 14y ago

That's why client-side encryption is useful, regardless of what some "security researchers" self-servingly say.

chmars 14y ago

IMHO confirms this incident the value of having an individual mail address for each site, service etc. Gmail has allowed for such individual mail addresses for years: username+loremipsum@gmail.com Example: johndoe+dropboxcom@gmail.com Mails addressed to johndoe+dropboxcom@gmail.com will be delivered to johndoe@gmail.com. They are easy to identify, filter etc.

AkThhhpppt 14y ago
That's not just GMail, that's all compliant email handlers; it's part of the RFC. Unfortunately, it's not guaranteed that the site you're signing up to can handle that address format - Facebook doesn't...
- chmars 14y ago
  Thanks, I had no idea of this RFC part.
- mitchellhislop 14y ago
  The new outlook.com also does not respect the RFC in this case, which I thought was especially funny.
- mgurlitz 14y ago
  While the RFC mandates the ability to send and receive email from user+detail@example.org it doesn't require that it go to user@example.org. It's an extension to the email standard, and you could have labels in another form if you wanted to, e.g. inbox0-user@example.org (http://tools.ietf.org/html/rfc5233 http://tools.ietf.org/html/rfc5233)
- nollidge 14y ago
  Right, but GMail not only allows +, it treats it special. That's not in the RFC, as far as I can tell.

rocky1138 14y ago

To increase security you can enable "email me when a new computer or app is linked to my account" in the account settings. It's not much, but at least you'll be notified when someone syncs their computer with your dropbox or adds your dropbox to their phone.

executive 14y ago

Not surprising. Remember, we're talking about a service that at times lets anyone login to another user's account without a password.