4 ms·

Not knowing that Dropbox offered a password manager … I misinterpreted the headline to mean I could no longer log into my Dropbox account with a password anymor

Not knowing that Dropbox offered a password manager … I misinterpreted the headline to mean I could no longer log into my Dropbox account with a password anymore (and thought they were forcing passkeys).

greyface- 1y ago
For me, the headline evoked memories of this 2011 Dropbox security incident. https://news.ycombinator.com/item?id=2678576 https://news.ycombinator.com/item?id=2678576
- sodality2 1y ago
  Hilarious that the bitrotted dropbox blogpost linked in the techcrunch article discussing this vulnerability (quoted as saying things like “this never should have happened”) instead redirects to some dropbox blog home page, with “What happens when AI joins your team?” prominently featured. Initially I thought their postmortem was blaming AI very openly 14 years ago :D
brundolf 1y ago
Same
alisonatwork 1y ago
This recently happened to me on Booking.com and... I ended up not using Booking.com to book a hotel. So long, genius status, or whatever. It absolutely drives me nuts that the western world is moving to "as seen in China" login-via-callback flow. Aside from the privacy issue of forcing people to attach an email or phone number or third-party auth provider to their every account, it's just a waste of time and energy to delete our passwords and force us through this weird multi-app flow just to log in to a service we spent years logging into without ever getting hacked. Imagine if every time you wanted to get into your house you had to press the doorbell and then wait for someone to call you back to decide whether you should be allowed in. It's absurd.
- ijustlovemath 1y ago
  This is especially true if you simply increase the minimum password length to a certain amount. The major browsers include password managers for specifically this purpose which can generate passwords; why don't we move towards educating users how to use these tools instead of centralizing all the failure points of the web? And yes, I understand the major conflict of interest in saving important passwords to Google, which I personally don't do and wouldn't recommend, but I think if they're interested in staying out of the Googleverse, we can also tell people about the good paid alternatives out there.
  - somenameforme 1y ago
    Paid vs Google seems a bit of a false dichotomy. Bitwarden and countless other such programs are completely free for normal usage. The freemium stuff comes in for business and uses far beyond just a password manager.
  - userbinator 1y ago
    why don't we move towards educating users how to use these tools instead of centralizing all the failure points of the web Because there are vested interests in doing the latter. That said, I don't trust password managers either.
- hug 1y ago
  > Imagine if every time you wanted to get into your house you had to press the doorbell and then wait for someone to call you back to decide whether you should be allowed in. This is exactly what I do to visitors to my house.
- bapak 1y ago
  All bets are on Passkeys, but I'm sure a lot of people can't deal with them due to lack of sync across devices. Passkeys are a great Trojan horse for password managers vs oauth, magic links, "password123" strings
- rafram 1y ago
  > "as seen in China" login-via-callback flow What, exactly, does this mean? But passkeys are the new hotness, not SSO, and what you’re describing is SSO. Passkeys aren’t tied to an outside account, just a password manager (which can be your browser - no account required).
windexh8er 1y ago
I was wondering, genuinely: is Dropbox still something the masses use? I found the product to be subpar many years ago and stopped using it and only seemed to read about it continuing to degrade.
- chromehearts 1y ago
  I always wondered this too .. I have a feeling their only users are those who just never migrated & users who used 10minmail (who upload "illegal" files (unreleased songs etc.))
  - omnimus 1y ago
    Where and why would you migrate?
- omnimus 1y ago
  At least in some circles yes. It is very much only sync service creative professionals use. Mainly due to conflict resolution, corruption and version history. It still has best implemented “online only files”. Think 10 person design studio all working in one big studio “Work” folder. So while the clients got bloated Dropbox still has edge in essentials. People trust it unlike other services some of which are straight up infamous for loosing your files like iCloud or corrupting them like adobe creative cloud.
  - microtonal 1y ago
    And block-level sync. Many sync services only do file-level sync.
  - Ferret7446 1y ago
    I don't suppose you know if any creatives use SyncThing? Curious to know how it compares
    - omnimus 1y ago
      I think that SyncThing does not solve other reasons (besides sync) why companies use Dropbox and thats backup and public download links. You can set up SyncThing with one always on instance on your NAS (we used to have that at work) but by that point it is quite technically challenging. And you still need to have some way to deliver downloads. For people like photographers something like Dropbox is probably harder requirement than Adobe.

greyface- 1y ago

For me, the headline evoked memories of this 2011 Dropbox security incident. https://news.ycombinator.com/item?id=2678576 https://news.ycombinator.com/item?id=2678576

sodality2 1y ago
Hilarious that the bitrotted dropbox blogpost linked in the techcrunch article discussing this vulnerability (quoted as saying things like “this never should have happened”) instead redirects to some dropbox blog home page, with “What happens when AI joins your team?” prominently featured. Initially I thought their postmortem was blaming AI very openly 14 years ago :D

brundolf 1y ago

Same

alisonatwork 1y ago

This recently happened to me on Booking.com and... I ended up not using Booking.com to book a hotel. So long, genius status, or whatever. It absolutely drives me nuts that the western world is moving to "as seen in China" login-via-callback flow. Aside from the privacy issue of forcing people to attach an email or phone number or third-party auth provider to their every account, it's just a waste of time and energy to delete our passwords and force us through this weird multi-app flow just to log in to a service we spent years logging into without ever getting hacked. Imagine if every time you wanted to get into your house you had to press the doorbell and then wait for someone to call you back to decide whether you should be allowed in. It's absurd.

ijustlovemath 1y ago
This is especially true if you simply increase the minimum password length to a certain amount. The major browsers include password managers for specifically this purpose which can generate passwords; why don't we move towards educating users how to use these tools instead of centralizing all the failure points of the web? And yes, I understand the major conflict of interest in saving important passwords to Google, which I personally don't do and wouldn't recommend, but I think if they're interested in staying out of the Googleverse, we can also tell people about the good paid alternatives out there.
- somenameforme 1y ago
  Paid vs Google seems a bit of a false dichotomy. Bitwarden and countless other such programs are completely free for normal usage. The freemium stuff comes in for business and uses far beyond just a password manager.
- userbinator 1y ago
  why don't we move towards educating users how to use these tools instead of centralizing all the failure points of the web Because there are vested interests in doing the latter. That said, I don't trust password managers either.
hug 1y ago
> Imagine if every time you wanted to get into your house you had to press the doorbell and then wait for someone to call you back to decide whether you should be allowed in. This is exactly what I do to visitors to my house.
bapak 1y ago
All bets are on Passkeys, but I'm sure a lot of people can't deal with them due to lack of sync across devices. Passkeys are a great Trojan horse for password managers vs oauth, magic links, "password123" strings
rafram 1y ago
> "as seen in China" login-via-callback flow What, exactly, does this mean? But passkeys are the new hotness, not SSO, and what you’re describing is SSO. Passkeys aren’t tied to an outside account, just a password manager (which can be your browser - no account required).

windexh8er 1y ago

I was wondering, genuinely: is Dropbox still something the masses use? I found the product to be subpar many years ago and stopped using it and only seemed to read about it continuing to degrade.

chromehearts 1y ago
I always wondered this too .. I have a feeling their only users are those who just never migrated & users who used 10minmail (who upload "illegal" files (unreleased songs etc.))
- omnimus 1y ago
  Where and why would you migrate?
omnimus 1y ago
At least in some circles yes. It is very much only sync service creative professionals use. Mainly due to conflict resolution, corruption and version history. It still has best implemented “online only files”. Think 10 person design studio all working in one big studio “Work” folder. So while the clients got bloated Dropbox still has edge in essentials. People trust it unlike other services some of which are straight up infamous for loosing your files like iCloud or corrupting them like adobe creative cloud.
- microtonal 1y ago
  And block-level sync. Many sync services only do file-level sync.
- Ferret7446 1y ago
  I don't suppose you know if any creatives use SyncThing? Curious to know how it compares
  - omnimus 1y ago
    I think that SyncThing does not solve other reasons (besides sync) why companies use Dropbox and thats backup and public download links. You can set up SyncThing with one always on instance on your NAS (we used to have that at work) but by that point it is quite technically challenging. And you still need to have some way to deliver downloads. For people like photographers something like Dropbox is probably harder requirement than Adobe.