7 ms·
Dropbox Introduces 2-Factor Authentication
- teach 14y agoI don't see any mention of 2-factor auth on the linked page. Maybe they're rolling it out in stages?
- irunbackwards 14y agoSeems like it to me as well, I don't see any options to do 2-factor auth on my settings page either. Maybe it's a pro feature right now?
- barik 14y agoIt's available to all users. But since it's experimental, you have to go here to enable it: http://www.dropbox.com/try_twofactor http://www.dropbox.com/try_twofactor Then it will appear under Security.
- SwaroopH 14y agoTry this: https://www.dropbox.com/try_twofactor https://www.dropbox.com/try_twofactor Although tray login still logs you in without the need to enter password or the code.
- irunbackwards 14y agoThat worked, thanks! Also, I just discovered a checkbox under 'Account Settings' that seems like it's an opt-in for early releases. OP probably already had this checked?
- josteink 14y agoCan't find that here. Care to post a screenshot somewhere? Anyone know how to enable this? Or if it can be enabled client-side at all?
- lowe 14y agohere's the full context from dropbox forums: https://forums.dropbox.com/topic.php?id=66910 https://forums.dropbox.com/topic.php?id=66910
- guylhem 14y agoNot working for Martinique (FWI), country code 596. Still waiting for a SMS to come. Asked twice 5 and 10 minutes ago. Maybe the country list should be edited to only list countries where SMS can be sent? (I have no problem with other 2-ways services I use)
- daveying99 14y agoLack of SMS shouldn't be a problem. You can use two factor authentication with the app version.It's on that same page.
- guylhem 14y agoYes but SMS are handy. BTW Just got both of them with a 7 hours delay.
- josteink 14y agoWorked for me. In Norway, for those curious.
- joshzayin 14y agoMore details: https://www.dropbox.com/help/363/en https://www.dropbox.com/help/363/en It looks like they support any app that uses the TOTP protocol, so google authenticator, among others, works with this seamlessly.
- icebraining 14y agoThat's nice. A little context: TOTP is part of OATH - Initiative for Open Authentication - and is an open standard published as RFC 6238. For those who don't have iOS/Android/BB and/or don't want to use Google Authenticator, Wikipedia lists a few compatible applications: https://en.wikipedia.org/wiki/Google_Authenticator https://en.wikipedia.org/wiki/Google_Authenticator These work for Gmail too.
- gcr 14y agoIs OATH related to OAuth?
- lowe 14y agonope! confusingly unrelated.
- guylhem 14y agoTried adding something very close (RFC 2289) to busybox - discussion is still on http://comments.gmane.org/gmane.linux.busybox/36136 http://comments.gmane.org/gmane.linux.busybox/36136 Finally gave up, considering how weird the idea seemed for most people. Glad that dropbox saw how interesting this is, especially in the light of the recent journalist hacks. Hopefully, icloud will be next :-)
- ch0wn 14y agoI'm glad they didn't invent their own mechanism but used standard OTP tokens, so you can just add them to apps like Google Authenticator.
- spindritf 14y agoThis is very convenient, Google Accounts, Amazon AWS[1], SSH[2], and Dropbox, all from one simple app. If Google Authenticator allowed to change the order of accounts without removing and readding them, I would have absolutely nothing to complain about. [1] https://aws.amazon.com/mfa/faqs/ https://aws.amazon.com/mfa/faqs/ [2] http://askubuntu.com/questions/159727/how-can-i-use-a-passcode-generator-for-authentication-for-remote-logins/159728#159728 http://askubuntu.com/questions/159727/how-can-i-use-a-passco...
- chmars 14y agoIn the iOS app, you can change the order by tapping 'edit' and then by drag and drop. The 'edit' button usually works if you tap and cancel the '+' button first.
- batgaijin 14y agoGreat, now only if they actually encrypted my files.
- matwood 14y agoPut a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?
- mapgrep 14y agoIf Dropbox were designed to handle sequentially-numbered blobs of encrypted data, changing one file would require your other devices to download only that file (an encrypted blob of roughly the same size). With a TrueCrypt volume or other encrypted file solution on top of Dropbox, you have to resync the entire multi-GB volume any time a single file in there changes, since to Dropbox it's just one big file. (Another option is to use something like an OS X sparsebundle -- encrypted data banded across many files -- but God help you if you have two computers reading/writing from that sparsebundle at once.) I've started using SpiderOak and it is quite efficient even though the data is encrypted such that the server admins couldn't see your data even if they wanted too. https://spideroak.com/engineering_matters https://spideroak.com/engineering_matters SpiderOak also offers two-factor auth. (The SpiderOak UI, however, is fairly atrocious.)
- icebraining 14y agoIf Dropbox were designed to handle sequentially-numbered blobs of encrypted data, changing one file would require your other devices to download only that file (an encrypted blob of roughly the same size). But they do: store files and name them sequentially ;) I think Encfs is the best solution, since it encrypts each file separately. Just mount the encrypted end over the Dropbox directory and the plaintext end somewhere else, and use it transparently.
- yafujifide 14y agoOnly part of a truecrypt volume changes when you make a change to the data within. Since Dropbox intelligently syncs files in parts, only part of a truecrypt volume has to be re-uploaded when something changes -- not the entire multi-GB file. I know because I do exactly this with a 1GB file. It takes about 2 minutes to sync when I unmount the file. Dropbox is not re-uploading all 1GB. However, like the other commenter, I still recommend encfs for most uses.
- jrockway 14y agoWell done. I wish more sites would move to using standard OTP protocols. I hate having to carry around and use a separate dongle for each company that provides two factor authentication.
- mwww 14y agoTwo-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/ http://blog.rublon.com/2012/why-add-rublon/
- teach 14y agoI've never heard of Rublon before now, but this post has started me off with a pretty negative impression. I'd suggest you work on your elevator pitch a bit more.
- spindritf 14y agoThis is neat but only requires a phone, there's no second factor.
- mwww 14y agoRight now the second factor can be the PIN code that you set up for your phone. Soon we'll add an optional intelligent PIN option for the app itself.
- alexlitov 14y agoHow entering 6 digits hard for users?
- deleted 14y ago[deleted]
- forsaken 14y agoI upgraded my account, and now the desktop client is not letting me login, saying I need the latest client. I downloaded that and it still gives me the same error..
- dkulchenko 14y agoYou'll need their "experimental build": https://forums.dropbox.com/topic.php?id=66910 https://forums.dropbox.com/topic.php?id=66910
- forsaken 14y agoThat is pretty horrible UX. Why would they enable it in the web UI, but make you look at a forum post to get the build you need. Also, without linking to it when you get an error on the build?
- irunbackwards 14y agoThe feature seems to have been released to forum users, then submitted here by a third party. I agree, though, there should have at least been a notification when the feature was enabled to read the forum post.
- steveeq1 14y agoDoes anyone know where I can download the latest Linux binary that support 2 factor authentication? I tried downloading the linux version, but it keeps on saying "this account uses two-step verification. To link to it, please download the latest version of Dropbox from www.dropbox.com/download". Maybe there is no new linux client, not sure.
- lowe 14y agoSorry for the confusion, this was a forum release. Linux build is here: https://forums.dropbox.com/topic.php?id=66910 https://forums.dropbox.com/topic.php?id=66910
- treelovinhippie 14y agoHmm, but I can still simply open someone's Dropbox folder locally if they forgot to logoff/switch on their computer...
- bigiain 14y agoThat's hardly an unexpected security hole - most of my devices maintain local copies of everything in my Dropbox folder (phone/iPad excepted). Requiring password/two factor auth to get at the cloud hosted version of something in the local filesystem would achieve pretty much nothing. Maybe there's people using Dropbox in some other fashion, but surely this is the intended/common use case?
- dkokelley 14y agoThat requires physical access, which is arguably more secure than internet access should your credentials be compromised. This is a major step in the right direction for Dropbox. I don't think it's Dropbox's job to encrypt and secure my local files. This would break many use cases, and there are other purpose-built solutions for this. Dropbox made their business on an extreme convenience (your files everywhere through a dead-simple, familiar interface). Inconveniently, convenience is often the enemy of security. It's a "good thing" that Dropbox is now offering some granularity over the convenience/security spectrum.
- reledi 14y agoMy security codes aren't working (invalid). Using Google Authenticator. Anyone else have this issue?
- sinsear 14y agoYup, have the same issue, went with sms-version because of this ;(. Google Authenticator on HTC Desire HD with custom ROM
- mryan 14y agoWhen I first used Authenticator I had this problem, because the clock on my phone was a couple of minutes out of sync. There is room for some error but it is worth making sure the time on your phone is correct.
- septerr 14y agoCarrying a set of backup codes when travelling, generating a code for each app that is linked to your account...these things make two way authentication seem very inconvenient. I went with converting my gmail account to use two way authentication but after being informed to remember to carry a set of 10 backup codes when I am going to be without my phone, was a turn off and I reverted to my old settings.
- peterwwillis 14y agoIf you want to get the most out of this, use a hardware token generator instead of a phone or computer. Example: http://hackaday.com/2012/07/11/time-based-one-time-passwords-with-an-arduino/ http://hackaday.com/2012/07/11/time-based-one-time-passwords... http://lab.infoserver.com.br/wiki/index.php/Projects:arduino-oath-token#Arduino_OATH_Token http://lab.infoserver.com.br/wiki/index.php/Projects:arduino...
- mertd 14y agoThat looks like a software generator running on Arduino.
- peterwwillis 14y agoI stand corrected. The device is more of a physical/hardware token generator than a phone or computer in that it's stand-alone. Phones with radios permanently switched off or computers without network access are probably as secure.
- mjs7231 14y agoYeay, now I can have a really secure login to my insecure files?