20 ms·
Evernote hacked
- mourique 14y agowhew, i was shocked when my evernote client asked me to enter my password because i did not recieve the e-mail. It seems like this was a precautious step as nothing was 'really' hacked, or was it?
- rdl 14y agoI've never really understood the security model for Evernote. It's "an exocortex" -- your personal notes, which are likely to be more security sensitive than general documents, email, etc. And yet they have even less security than Dropbox, themselves not exactly an exemplar of robust security. They've got competent people operating the service; it's just not well designed for security.
- MartinMond 14y agoYeah, Evernote really should have been zero-knowledge end-to-end encrypted. Recently https://crypton.io/ https://crypton.io/ was released and my hope is that lots of new SaaS offerings will use it and that this will in the end force even the big names (Dropbox, 37signals, etc) to adopt real security.
- jpdoctor 14y ago> to adopt real security. Won't happen until it's perceived that the lack of security is costing them money.
- quinndupont 14y agoPersonally, I've complained to them that as a premium user I should be given the option to fully encrypt a notebook (zero-knowledge style, so only I have the keys). This prohibits all the social network-type sharing stuff though, so they are uninterested in doing this (same with Dropbox). It's a fundamental issue, but I hate that these companies think they should put "sharing" ahead of "security".
- ncryptedcloud 14y ago(Disclosure I work for nCrypted Cloud) The FREE product is still in Beta but the Pro version (due out in two months) WILL allow you to request zero knowledge and there will be no Recovery key. I know that you know that this means that if you ever forget your password, there is no helping you but I say it so that others reading this understand the dangers of this. Why are we going to supply this functionality then? Because users keep requesting it
- brisance 14y agoI'm not a technical person, but how would they be able to search and index the items if everything is encrypted?
- MartinMond 14y agoThey wouldn't be able to do this on the server side. However their native iOS, Mac, Windows clients could just create&update the search index locally and sync the encrypted version. With HTML5 localStorage this also works in Web Apps. Of course there's a tradeoff, but for me that's easily worth it.
- 14y ago
- jms703 14y agoI don't understand why they don't offer encryption.
- UnoriginalGuy 14y agoEncryption on /what/? Point to point or content encryption? Also if your password has been compromised and that same password is used to encrypt your data then what exactly would encryption do?
- martinkallstrom 14y agoPasswords are typically not used for encryption, since you don't want to re-encrypt data when user changes the password.
- lawnchair_larry 14y agoYes they are, just in a more complicated way. You don't have to re-encrypt if the user changes their password. FDE would be pretty useless if so.
- jms703 14y agoEncryption on the notes. Who would ever promote using the evernote login to encrypt?!
- quinndupont 14y agoData encryption with a private key that the user holds. Evernote, like Dropbox, etc. have your crypto keys, and thus will always be subject to hacking and such. If I, and only I, had the keys it would be up to me to keep them safe, and my data would not succumb to a hack of their database, etc.
- UnoriginalGuy 14y agoBut password resets would quite literally be impossible.
- 14y ago
- Nyr 14y agoAnd following the announcement, the blog it's down and emails didn't arrived yet. Well done, Evernote.
- kmfrk 14y agoService currently unavailable. Here is their latest tweet: Important: Evernote just implemented a service-wide password reset. Please read our post for details and instructions Said post is unavailable by the look of it. Can someone post a paste of the blog post in here?
- lucb1e 14y agoThey aren't down (anymore), but in case you are still unable to read it: ----- Evernote's Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and instructions. In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed. The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords. Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.) While our password encryption measures are robust, we are taking additional steps to ensure that your personal data remains secure. This means that, in an abundance of caution, we are requiring all users to reset their Evernote account passwords. Please create a new password by signing into your account on evernote.com. After signing in, you will be prompted to enter your new password. Once you have reset your password on evernote.com, you will need to enter this new password in other Evernote apps that you use. We are also releasing updates to several of our apps to make the password change process easier, so please check for updates over the next several hours. As recent events with other large services have demonstrated, this type of activity is becoming more common. We take our responsibility to keep your data safe very seriously, and we're constantly enhancing the security of our service infrastructure to protect Evernote and your content. There are also several important steps that you can take to ensure that your data on any site, including Evernote, is secure: Avoid using simple passwords based on dictionary words Never use the same password on multiple sites or services Never click on 'reset password' requests in emails — instead go directly to the service Thank you for taking the time to read this. We apologize for the annoyance of having to change your password, but, ultimately, we believe this simple step will result in a more secure Evernote experience. If you have any questions, please do not hesitate to contact Evernote Support. The Evernote team
- Ensorceled 14y agoI'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...
- rdl 14y agoSeriously, who doesn't do 2fa for something like this in 2013? Or 2012, or even 2011?
- kmfrk 14y agoApple, Microsoft, Yahoo (at least non-US), etc. ... I'm not sure if there are any bookmark services that actually support this, though it'd be a decent selling point. It was a big deal, when Google finally assed themselves to implement it for Gmail, but companies have been embarrassingly slow in following their example. Especially when they provide e-mail services. Twitter hired TFA specialists a few months back, but they are taking their sweet time about implementing the system. I've wondered for a long time why social networks aren't on top of implementing this. It's the SSL discussion all over again.
- rdl 14y agoGoogle Chrome does bookmark sync using user-provided passphrase, so I'd consider that bookmark service with client side crypto and 2fa. Crappy consumer services not supporting 2fa is somewhat understandable. No one uses Apple or Yahoo web services for business. People do seem to use Evernote in business contexts. Google Apps for your Domain is a fairly legitimate business option, as is Google Docs.
- kmfrk 14y agoRight, forgot Chrome. I only thought of Opera, when it comes to browser-backed bookmark sync - at least on paper, since it doesn't work at all for me.
- UnoriginalGuy 14y agoThe following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and instructions. In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed. The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords. Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.(http://en.wikipedia.org/wiki/Salt_(cryptography) http://en.wikipedia.org/wiki/Salt_(cryptography) )) While our password encryption measures are robust, we are taking additional steps to ensure that your personal data remains secure. This means that, in an abundance of caution, we are requiring all users to reset their Evernote account passwords. Please create a new password by signing into your account on evernote.com(https://www.evernote.com/Login.action https://www.evernote.com/Login.action). After signing in, you will be prompted to enter your new password. Once you have reset your password on evernote.com, you will need to enter this new password in other Evernote apps that you use. We are also releasing updates to several of our apps to make the password change process easier, so please check for updates over the next several hours. As recent events with other large services have demonstrated, this type of activity is becoming more common. We take our responsibility to keep your data safe very seriously, and we’re constantly enhancing the security of our service infrastructure to protect Evernote and your content. There are also several important steps that you can take to ensure that your data on any site, including Evernote, is secure: Avoid using simple passwords based on dictionary words Never use the same password on multiple sites or services Never click on ‘reset password’ requests in emails — instead go directly to the service Thank you for taking the time to read this. We apologize for the annoyance of having to change your password, but, ultimately, we believe this simple step will result in a more secure Evernote experience. If you have any questions, please do not hesitate to contact Evernote Support(http://evernote.com/support http://evernote.com/support). The Evernote team
- eliot_sykes 14y agoBlog was down. Google cache of blog post: http://webcache.googleusercontent.com/search?q=cache:http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ http://webcache.googleusercontent.com/search?q=cache:http://...
- melvinmt 14y agoThat's why I don't use any fancy services for my notes, which usually contains sensitive data. I simply use Notational Velocity which encrypts my notes and stores it locally. It does provide a synchronization option with SimpleNote but they can't even be bothered with using SSL.
- mmagin 14y agoAnd another example of how badly Wordpress scales.
- ga0bi 14y agoI filed a ticket this morning after I was unable to login to the Mac client. Here's their response: "Dear Valued Customer, We're truly sorry for the inconvenience this has caused you this morning. We are attempting to contact our entire userbase about this matter, but we feel that immediate action in these cases is the most prudent course." The rest of the email contained the contents of their blog post.
- rburhum 14y agoFunny enough, logging in to Evernote was the first thing I did after laying in bed spending 1hr+ watching this amazing video about http/https man-in-the-middle attacks using sslstrip http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/ . Not a good way to start my morning.
- jerrya 14y agoI find evernote tremendously helpful and I pay the $5 per month for a premium service, REGARDLESS, a google of https://www.google.com/search?q=evernote+two+step+authentication https://www.google.com/search?q=evernote+two+step+authentica... says little good about how Evernote respects me or their many many other customers whom have repeatedly asked for two factor authentication.
- seldo 14y agoI note that when Twitter released their breach notice on a Friday afternoon there were comments accusing them of trying to "bury" the news: http://news.ycombinator.com/item?id=5154502 http://news.ycombinator.com/item?id=5154502 While there are (so far) no such comments about Evernote releasing this stuff on a Saturday morning. I think security breaches are just discovered at inconvenient times.
- makeramen 14y agoI managed to reset my password to the same that it was before. I changed it again right away of course, but there should definitely be some protection against that. (FWIW I didn't get the email so I was simply locked out and used their "forget password" form instead of trying to log in, which may have a different reset process).
- mhartl 14y agoThis morning I tried to use the same password and it wouldn't let me, so maybe they fixed this issue.
- SonicSoul 14y agoi didn't get the email, and my original password still works, it just took me directly to change password screen. i guess they're counting on compromised passwords not being used individually to create new ones?
- SonicSoul 14y agoaccording to bbc "It said user names, email addresses and encrypted passwords were accessed" so i guess since passwords were encrypted they weren't fully compromised and a simple change should be enough.. at least that's what Evernote appears to think. http://www.bbc.co.uk/news/technology-21644317 http://www.bbc.co.uk/news/technology-21644317
- lucb1e 14y agoI am impressed by how well this is handled. Much better than I've seen from other companies!
- yabatopia 14y agoI didn't get an email (yet) so I visited the Evernote Forum. I was a bit surprised to see that I had to sign in with the same username and password of my Evernote account. It's convenient, but I prefer seperate accounts, especially since they're using third-party forum software.
- bthomas 14y ago> we have found no evidence that any of the content you store in Evernote was accessed This depends on how hard they looked - do people believe content wasn't accessed? Is it fair to ask them for a technical post about why they don't think content was hacked? I'd love to know how they separate auth from content, and how they ensure that a hacked auth node can't view notes
- senthilnayagam 14y agoAnybody considered the zendesk link http://m.techcrunch.com/2013/01/08/zendesk-evernote-25k/ http://m.techcrunch.com/2013/01/08/zendesk-evernote-25k/ Twitter, tumblr, Pinterest hacks are all having zendesk connection People on Dropbox have issues too
- colinmegill 14y ago"Please create a new password by signing into your account on evernote.com(https://www.evernote.com/Login.action https://www.evernote.com/Login.action). After signing in, you will be prompted to enter your new password." Why couldn't an attacker do that at this point?
- lysium 14y agoI'm wondering how they perform the password reset. Surely, you must know more than the username. But they cannot rely on the old password either, because the whole thing was set off by assuming that the old password is hacked. And they advise their user to ignore instructions per email. So how do / could they do it?
- uptown 14y agoIt contradicts their instructions, but I'm assuming using the password-reset received email immediately following my request for this email is the "right" way to do this. I believe the intent of what they warned against were common phishing emails .
- ams6110 14y agowe have found no evidence == "we really don't know" Sorry, I'm sure the Evernote tech team is competent, but clearly some marketing spin has been put on this announcement.
- moe 14y agoSorry, I'm sure the Evernote tech team is competent What exactly leads you to this assumption? They designed a service that stores sensitive user-data in an obviously insecure fashion (no end-to-end encryption). If that's not incompetence then the only other explanation would be criminal negligence?
- drivebyacct2 14y agoIf they said, within hours, "We know they took nothing", they'd almost surely be lying, intentionally or otherwise.
- moe 14y agoLet me be the first to say: HA-HA! </nelson> Over the past few years I've told everyone to refrain from using Evernote. I told them that Evernote doesn't use end-to-end encryption and that eventually this would happen. Hardly anyone would listen ("You're just paranoid", "I don't store anything private in there anyway, except.. oh"). For once I take cruel pleasure in being "that guy". The general public needs to learn this lesson.
- marcuspovey 14y agoGood they're being proactive here, but two things: 1) I'm sick of going through this password reset crap every month or so. Please lets get rid of passwords. 2) Could Evernote please look at some sort of oauth based signin for mobile devices? I have to enter this unique and very long password multiple times on every device I own. It'd be nice if my linked phone and tablet didn't need me to use the same login system as a human.
- Stratoscope 14y agoFor anyone who is as puzzled as I was about how to change the password in the Android app, the answer is you can't change it in the app. (!) Instead, you have to tap the "authentication failed" notification. Then you can change the password.
- scrrr 14y agoYeah apparently they will deploy updated versions of the apps to address that issue though. (It says so at the bottom of the article.)
- deleted 14y ago[deleted]
- DocG 14y agoNot cool. I use evernote for throwaway email passwords. And storing some usernames, without passwords. Just to remember usernames. I wouldn't lose anything, it would be just inconvenient for me.
- drivebyacct2 14y agoMaybe use a more appropriate tool? That would be your life way easier anyway? LastPass? 1Pass, etc?
- xutopia 14y agoAnyone know a good Skitch replacement?
- ActVen 14y agoYou can actually download Skitch 1.XX here: http://update.skitch.com/skitch.html http://update.skitch.com/skitch.html I have been using it since they completely messed up Skitch with the 2.XX update. It requires absolutely no connection to evernote and works great.
- santiagoIT 14y agoI got the email and reset my password (web browser on desktop). I then launched the MaxOs client app and it asked me to enter the new password, however the iOS app shows its initial loading screen but then just crashes. It never gets around to asking me for the new password. Anyone know a solution to this?
- santiagoIT 14y agoAn updated iOS app is available since yesterday. After updating I was able to enter the new password and am back up and running.
- mdp 14y agoThey've never really been focused on security in the past. Honestly, I love the service, but their lack of concern about keeping it secure has never sat well with me. I wrote up a post with some of my security concerns. http://news.ycombinator.com/item?id=5311010 http://news.ycombinator.com/item?id=5311010
- mieubrisse 14y agoIn the post, they say: "The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords. Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.) While our password encryption measures are robust, we are taking additional steps to ensure that your personal data remains secure. This means that, in an abundance of caution, we are requiring all users to reset their Evernote account passwords. Please create a new password by signing into your account on evernote.com." What it doesn't say is how the passwords were dumped in the first place, or what they're going to do to ensure it doesn't happen again (outside of taking "additional steps"). I understand that not all users of Evernote are technical, but I'd like some peace of mind that a similar thing is less likely to happen in the future.
- tlrobinson 14y agoAny suggestions of migration paths to more security conscious alternatives? I'd even be happy with an encrypted disk image on Dropbox if there's a good way to OCR scanned docs, then be able to search them.
- ncryptedcloud 14y ago(Disclosure, I work for nCrypted Cloud) Since you ask and since you appear to be a Dropbox user looking for more security, check out www.ncryptedcloud.com It is a Privacy, Security and Collaboration app that layers on top of dropbox (Skydrive and Googledrive soon)
- apapli 14y agoFrustrating, I thought they would have done security better than most given the type of information stored here. Does anyone know a decent password keeper? I have a list of logins/passwords for my key sites in a word .doc file stored locally, but given I have a work mac, home mac, tablet and iPhone it really is a pain to access the locally stored file. I thought about saving this file on google drive, but their 2-factor auth doesn't seem to apply for drive (only gmail). How do others do this - is there a way to store an encrypted file somewhere online, then typing in a known password to unencrypt / open it when I need to access it?
- firloop 14y agoLastPass offers everything that you're mentioning, plus 2-factor auth that integrates with the Google Authenticator app if you want. It's free if you use it on desktop with browser extensions, but costs $1/month for mobile. I would highly recommend checking it out. www.lastpass.com
- drivebyacct2 14y ago>I thought about saving this file on google drive, but their 2-factor auth doesn't seem to apply for drive (only gmail). Huh? All of Google's logins are through their single-sign-on. TFA protects everything. Also, please, just use LastPass. I don't know why everyone has it in their head that password managers are a hassle. It's literally easier than using the same password for everything AND more secure.
- deleted 14y ago[deleted]
- jrockway 14y agoI finally made the switch to randomly-generated passwords for everything, so for once I can finally not care at all that this happened. It's just a reminder that I need to close my Evernote account.
- hgezim 14y agoI just got an email from "Evernote" with links pointing to http://links.evernote.mkt5371.com/ http://links.evernote.mkt5371.com/ Please, be very careful, people. Of course, this won't reach the people who need to hear it :(
- freewizard 14y agoWhy not share more about the hack detail? Is it another attack from China? As a (paid) user, I'm a bit concerned about my data security.