4 ms·

Dropbox did not get hacked. One of their employees used the same password on multiple other sites, and one of those got hacked. This is awful journalism.

yelloweye 14y ago
Really? Why an employee is keeping customers email address in his/ her dropbox account. What kind of internal control Dropbox is employing? There is an limit to dropbox fanboism.
jasonzemos 14y ago
Security is fungible. You're applying some subjective standard that divides what constitutes a hack and what doesn't. If I had to guess, you wouldn't treat a buffer overflow where some code was executed the same way. This is arbitrary. Considering a dropbox employee, corporate information, and internal security practices are on the line here: I think the author made the fair, ethical call.
- sillysaurus 14y ago
  No, the article is flat-out wrong. "Dropbox got hacked" means their system security is breachable by a malicious attacker. This is simply not true.
  - yen223 14y ago
    I would think that if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts, that would constitute a security breach.
    - sillysaurus 14y ago
      if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts ... That didn't happen. The employee account merely contained a list of email addresses.
      - aprendo 14y ago
        User account data. Not as bad. Still awful. Hacked is a perfectly valid term to use. Dropbox allowed their employees to have user data just lying around and their policy on how employees have to treat that data seems either ineffective or non-existant. I don’t really care that a human and not a piece of software written by a human was the point of failure here. Hack seems like the perfectly applicable term.
      - arrrg 14y ago
        That’s not really a response, is it? User account data could be accessed – because Dropbox was unable to protect your data. That’s not quite as awful a access to user account but it’s still awful.
piggity 14y ago
A few years ago... RSA was hacked and the attackers could then get access to US military contractor internal data. ... LinkedIn was hacked and the attackers could then get access to DropBox internal data. Would the military contractors claim that they weren't hacked?
- drivebyacct2 14y ago
  Given that the RSA intrusion was known and the government didn't take steps to change passwords, sure. In this case, it's perfectly fair to say the Dropbox employee stupidly allowed their email to be hacked. But making it sound as if Dropbox's security was compromised is misleading and inaccurate IMO.
tripzilch 14y ago
Security is as strong as your weakest link. If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference. This is the same silliness that makes people claim that social engineering isn't actually a security breach "oh they just phoned up the front desk and convinced them to be granted access, who would fall for that, that's not hacking!", yeah, no, someone just got 0wned.

yelloweye 14y ago

Really? Why an employee is keeping customers email address in his/ her dropbox account. What kind of internal control Dropbox is employing? There is an limit to dropbox fanboism.

jasonzemos 14y ago

Security is fungible. You're applying some subjective standard that divides what constitutes a hack and what doesn't. If I had to guess, you wouldn't treat a buffer overflow where some code was executed the same way. This is arbitrary. Considering a dropbox employee, corporate information, and internal security practices are on the line here: I think the author made the fair, ethical call.

sillysaurus 14y ago
No, the article is flat-out wrong. "Dropbox got hacked" means their system security is breachable by a malicious attacker. This is simply not true.
- yen223 14y ago
  I would think that if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts, that would constitute a security breach.
  - sillysaurus 14y ago
    if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts ... That didn't happen. The employee account merely contained a list of email addresses.
    - aprendo 14y ago
      User account data. Not as bad. Still awful. Hacked is a perfectly valid term to use. Dropbox allowed their employees to have user data just lying around and their policy on how employees have to treat that data seems either ineffective or non-existant. I don’t really care that a human and not a piece of software written by a human was the point of failure here. Hack seems like the perfectly applicable term.
    - arrrg 14y ago
      That’s not really a response, is it? User account data could be accessed – because Dropbox was unable to protect your data. That’s not quite as awful a access to user account but it’s still awful.

piggity 14y ago

A few years ago... RSA was hacked and the attackers could then get access to US military contractor internal data. ... LinkedIn was hacked and the attackers could then get access to DropBox internal data. Would the military contractors claim that they weren't hacked?

drivebyacct2 14y ago
Given that the RSA intrusion was known and the government didn't take steps to change passwords, sure. In this case, it's perfectly fair to say the Dropbox employee stupidly allowed their email to be hacked. But making it sound as if Dropbox's security was compromised is misleading and inaccurate IMO.

tripzilch 14y ago

Security is as strong as your weakest link. If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference. This is the same silliness that makes people claim that social engineering isn't actually a security breach "oh they just phoned up the front desk and convinced them to be granted access, who would fall for that, that's not hacking!", yeah, no, someone just got 0wned.