The Dropbox hack is real

https://www.troyhunt.com/the-dropbox-hack-is-real

by joshschreuder • 10 years ago

1313 537 10 years ago

Repeating from the other thread:

I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance.

HIBP is a truly essential service and I'd be happy to pay more. Even with good password discipline it's useful knowledge on your exposure and I cannot recommend it enough. He mentions it near the end but this is one of those no brainers that should be repeated very loudly.

https://haveibeenpwned.com

djhworld• 10 years ago

Thanks for linking to this site, it says my address was breached in Dropbox, LinkedIn, Gawker media(?) and Tumblr

I changed my Dropbox password last week after they sent the email, same with LinkedIn.

Great site though

ashitlerferad8• 10 years ago

It really is about time we stopped using passwords.

markild2• 10 years ago

Honestly curious, what should we use?

treahauet• 10 years ago

Agreed. I've just donated, and the link for that is https://haveibeenpwned.com/Donate

donw2• 10 years ago

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well.

I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices.

For your critical services, keeping encrypted copies of your backup codes is a must.

TTPrograms• 10 years ago

Note the hack was in 2012. Hopefully most people have rotated passwords by now.

ashitlerferad8• 10 years ago

Anyone know of automated ways to rotate all the passwords on all of our accounts across the web?

diroussel• 10 years ago

Normal people don't rotate passwords unless they are forced to.

voltagex_• 10 years ago

I still feel squeamish about Authy having all the tokens - what happens when they get breached?

donw2• 10 years ago

2FA is an extra layer of protection, not a panacea.

A successful attack would require both an Authy breach and that the attacker have passwords for the services that they want to compromise.

This should buy you enough time to regenerate your 2FA tokens to mitigate the threat.

microtonal5• 10 years ago

this is probably a good time to set up Two-Factor Authentication (2FA) as well.

Note: Dropbox also supports U2F for 2FA, which provides much better protection agains phishing.

https://blogs.dropbox.com/dropbox/2015/08/u2f-security-keys/

ascorbic2• 10 years ago

If you use a YubiKey then you can move tokens between devices without needing to trust a third party, nor worry about them somehow being exfiltrated from your phone.

https://www.yubico.com/

bluejekyll• 10 years ago

Has anyone had yubikey fail?

I have one on my keychain, never an issue in years, but I can't help but be concerned, one day, I will be locked out...

cm218711• 10 years ago

2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec. Sometimes a lot longer (some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time, and then you have the time it takes to find your phone, unlock, decline twice the iOS update prompt, go to the right app, find the right msg, copy the code, check it is correct, etc etc).

Yeah if it is really a critical service and rarely used, we should. But if I have to wait 30sec in front of a login box every time I go on netfix or on amazon, you can bet their sales will go down the drain.

jsmthrowaway4• 10 years ago

I have my 2FA in Notification Center and consider this fine given that it's second factor. With that, it's about eight seconds for me involving one slide of my finger. I'm also mystified that you think support for 2FA and mandatory 2FA are the same thing, particularly for something like Netflix.

gjulianm• 10 years ago

Most services have the option of remembering your 2FA authentication on a certain device. For example, I have to enter my LastPass password in my computer to login, but I only have to use 2FA if I'm logging in from a new device.

creshal2• 10 years ago

some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time

SMS isn't real time either, it's best effort. Mostly (~99,9%) it gets through within seconds, but delays of a few minutes are perfectly acceptable to telcos. As service provider you can't do much about it, either pay through the nose for "priority" delivery (which maybe halves the amount of delayed messages in our experience) or tell your customers to switch mobile providers (yeah, good luck with that).

wtbob• 10 years ago

2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec.

That's definitely true, and it's definitely annoying. But one is not logging in every day (or even, I hope, every month: 90-day cookies are safe enough).

wrsh072• 10 years ago

You auth machines you use regularly so that login is 30 seconds once.

That's not such a high penalty so that devices you've physically used are authorized and all others aren't.

wrboyce2• 10 years ago

I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now.

The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which I cannot disable) prompting me to backup every time I use the app. I don't know why they are so determined to get hold of my OTP keys, but it isn't happening.

I'm currently using an app called "OTP Auth" and it seems quite nice, and is quick to use.

rtpg• 10 years ago

a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely

I would recommend testing theories of :

- losing phone

- losing computer

- losing both

and have reasonable backup strategies for these scenarios.

tdkl2• 10 years ago

the app tries to get me to backup my keys to their servers

That's the idea for using Authy.

epimenov2• 10 years ago

1Password can do 2FA, also syncs between all your devices. And no trusted 3rd party cloud service.

jonathanoliver• 10 years ago

Keeping all the keys (password and 2FA tokens) in 1Password means it isn't true 2FA anymore:

https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-...

raverbashing3• 10 years ago

And what happens if 2FA seeds are stolen from the site?

angry-hacker• 10 years ago

I also recommend authy. Makes 2fa slightly less painful.

Not a fault of authy, but namecheap and paypal both don't offer support.

I'm especially angry at namecheap because their homegrown 2fa solution is unreliable. Especially when travelling. I'm considering leaving them agter 4 years of promises to support authy but nothing!

et-al• 10 years ago

Ugh, tell me about it. I check this page every now and then and just notice new comments and a response from Evgenia S. that the team is working on it:

https://www.namecheap.com/support/knowledgebase/article.aspx...

FWIW, Gandi.net supports TOTP, but their prices are a bit higher. However if you only own a handful of domains, the $20/year difference won't really matter.

willvarfar3• 10 years ago

50% of the leaked hashes were bcrypt and the other 50% were salted sha1.

So, asking the HNers who crack passwords or follow the tech closely and have a good feel:

Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt?

And how can this be projected to change in the next couple of years?

cm218711• 10 years ago

Mostly what Troy says is that the sha1 were salted with a salt not available in the files he was provided. That doesn't mean the salt wasn't leaked. But if it wasn't, and the salt was a 128bit, unique to each password, cryptographic random salt, I'd say they are not really vulnerable. So it depends on the strength, randomness and availability of the salt.

tonicoto3• 10 years ago

How come the salts aren't available? Did the attacker choose not to release them, or were they stored elsewhere?

mmaunder2• 10 years ago

The salts for the sha1 passwords weren't leaked. So they're hard to crack in practical terms. Depends how random they were.

See hashcat docs and benchmarks for complete answers to your questions. The GPU versions of hashcat.

willvarfar3• 10 years ago

I actually googled before asking my question, and couldn't come up with a good feel for just how crackable these are with hashcat... I guess I don't know the terms or the prices.

Is anyone able to make any sense of the GPU hashcat benchmarks that are posted? Something distilled down to "if you spend $xxx, then you can crack any salted sha1 under 12 letters+digits+punctuation in n hours if you knew the salt; if its bcrypt, that would take x hours". Something like that ;)

Added: I'm a bit confused how the attackers know the hash and not the salt though; normally they are stored side-by-side. Or were dropbox using a site-wide salt?

(I've seen systems with a site-wide salt hardcoded into the codebase and a per-user salt in the db with the hash; This means attackers have to compromise both sourcecode and db to get far.)

technion• 10 years ago

I think it's quite unlikely whoever took control of this managed to dump an entire database but couldn't access a password salt.

Do we know for sure these were "salted SHA"? It could well be "SHA1-HMAC through an HSM", and thus, actually be the stronger option.

Alternatively, someone has probably kept a lot of cracked passwords to themselves.

viraptor• 10 years ago

It depends how many rounds of sha1 were used and what was the load setting on bcrypt. You can make either one harder to break by playing with those parameters.

imaginenore• 10 years ago

SHA1 is not necessarily weaker. They might have used many rounds of hashing, which could have made them even stronger.

aluhut9• 10 years ago

Self hosting is my way to go. Had enough of this.

My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free.

How about...not? There are tiny open source tools for every OS. You can do it locally, save it on a stick or on your damn phone...why taking more risks especially facing this massive fail here?

thomasahle• 10 years ago

Self hosting is the way to go.

Because you can secure it better than them? Or because you'll be less of a target?

microtonal5• 10 years ago

It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support).

E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data.

(Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com)

cm218711• 10 years ago

Arguably, this leak seems to have been the result of password reuse. If you store your data with millions of people and 200 employees have a way to access it, your are exposed to

1. An interesting phishing target for a hacker

2. Lots of employees who can fuck up, a hacker only needs one, one time

I'd say the probability you will be hacked is probably less if you use like a Synology with a reasonably strong password and automatic system updates.

loup-vaillant2• 10 years ago

For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength.

Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).

cel1ne5• 10 years ago

I trust 1Password more than lastpass or keypassx.

tonyedgecombe• 10 years ago

Why?

the_other• 10 years ago

I use them too, and like how they operate. They have the best update notes of any company I've seen (on Apple's App store) - enthusiastic, entertaining, detailed, consistent. None of this guarantees quality, but it certainly paints a picture of a committed team.

rickycook• 10 years ago

that's true, but 1p is far better than the open source options. it also has wifi sync between devices, so your fault never leaves your devices via anything but trusted, local connections if that's what you want

aluhut9• 10 years ago

How is this "far better"? It's just some additional feature you've described here. I wouldn't need it. So it does nothing better for me as far as I can see it.

100111002• 10 years ago

  a subscription service 
  for $3 a month and you 
  get the first 6 months 
  for free.

...and now, a word from our sponsors.

microtonal5• 10 years ago

And that puts your data in a (password) silo.

aorth• 10 years ago

@dang Can we please change the URL to not have the query parameters?

ashitlerferad8• 10 years ago

I'd go with automatically stripping all utm_* query parameters from all URLs.

MichaelApproved• 10 years ago

What's the harm?

hackernews2000• 10 years ago

I do it with this extension: https://github.com/einaregilsson/Redirector/

joshschreuder• 10 years ago

Sorry about that, I submitted the link directly from my RSS feed. I'll trim that stuff if I submit in the future.

peteretep• 10 years ago

Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?

tehbeard• 10 years ago

Xkcd's correct-horse-battery-staple technique?

arianvanp2• 10 years ago

Check out diceware. Easy technique to memorise a lot of entropy

cm218711• 10 years ago

Keep your password written on a piece of paper in your wallet, with a few extra characters you need to remember to ignore.

jethro_tell2• 10 years ago

or a few extra characters you need to add. As much as people say this is a bad idea, most of the people you would be trying to keep out, don't have access to your wallet.

I did this for a few months for a master password and set everything to forget the password so I used it several times a day. After a little while I can get rid of the paper and have a LONG random password that is committed to memory.

loup-vaillant2• 10 years ago

Here's the advanced version, that let you use different, mostly uncorrelated passwords for different services. http://blog.jgc.org/2010/12/write-your-passwords-down.html

I have implemented a little program to generate such a square: http://loup-vaillant.fr/projects/password-generator

Though by now, I find this a little tedious. I'm thinking of using an encrypted password database, protected with a diceware generated password. That way I will be able to copy&paste my passwords instead of typing them by hand.

stephengillie• 10 years ago

Use 2 factor authentication and rotate both passwords. I have the opposite setup - Dropbox password is random and the password manager (stored inside) is memorized. It would be harsh to lose access, but not unrecoverable.

staticelf2• 10 years ago

Switch to SpiderOak: https://spideroak.com/

have_faith3• 10 years ago

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website.

This way I don't ever remember a password, I just remember the system.

chii• 10 years ago

Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...

jrs235• 10 years ago

When one of the sites you use gets breached, you'll want/need to change your password and won't be able to use the same single algorithm. This will throw things of as you won't be able to use a single algorithm. Sure you could not use two. But you'll need to remember what sites use which one.

philovivero• 10 years ago

How do you deal with websites that won't let you use >8char or certain characters?

I use this same method, but my method will often generate special characters, and AWS as an example, and several others (apparently following AWS' lead) won't let you use those. (Any punctuation not on the shift-numbers row of USA keyboards are not considered legit for password use)

I still mostly use this system, and given my lucky memory I can memorise the exceptions, but I doubt a vast majority of the population could follow my example.

gwbas1c2• 10 years ago

As long as your Dropbox password is unique, you're all set.

wepple3• 10 years ago

You can keep 1pass on an iOS device, and auth using fingerprint. Ultimately you're still going to need/want to know the actual underlying passwords to both iOS and 1pass, however.

crummel• 10 years ago

Are 1Password's files not encrypted? Store it publicly on your web site, email it to your friends, print it out in base64 in a machine-readable font and keep copies pinned on the wall of your cube. You still have to remember one password but at least you're depending on crypto instead of Dropbox's security.

marco12• 10 years ago

Exactly this. Or just store a copy on another device of yours, on a USB flash drive, etc.

0x02• 10 years ago

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could see your pattern and start spamming by guessing popular services.

On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no...

cm218711• 10 years ago

I cannot agree more, I do the same, and invite everyone else to do so.

- Useful as a canary of which website has been breached

- Useful as a canary of which website sold your details

- and if your details are in the wild, you can stop the spam by deleting the address

Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

markdown• 10 years ago

Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Isn't that how chip-and-pin works?

znebby3• 10 years ago

For credit cards, check out privacy.com

I recently started using it, works great.

raverbashing3• 10 years ago

Is there a service (email host) that can give you "infinite email aliases"?

(Yes, I know about the '+' in gmail, but I suspect the word is out on it)

Spooky23• 10 years ago

Re: credit cards, unless you insist on using debit cards for some reason, who cares if they are compromised.

If someone steals my credit card, AMEX has a problem. I'll take reasonable care, but I'm not going to generate transaction specific numbers or whatever unless there is a strong incentive to do so.

krupan3• 10 years ago

"a unique authorization code specific to this vendor or this transaction and useless to any other actor"

Sounds a lot like a bitcoin address.

krstck• 10 years ago

I wish phone numbers could work this way. When my personal data gets leaked or sold, just revoke access to that particular token.

CookieMon2• 10 years ago

Unique-per-service email addresses work pretty well as a canary for breaches

I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with.

Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks of SMTP routes are breached and picking up confirmation emails, or there's a giant iceberg of pwnage floating beneath the surface out of view.

jmknoll• 10 years ago

giant iceberg of pwnage floating beneath the surface out of view

Very poetic. I'd like to see this made into one of those motivational posters and hung in the office of every dev team nationwide.

Syzygies• 10 years ago

I used to use unique middle addresses for magazine subscriptions, back when magazines were physical. I'd get credit offers with middle name "Byte". Consumer Reports used to include a false advertising hall of shame; I loved sending them an example sent to middle name "CR". They didn't use it, or even answer.

bo1024• 10 years ago

Or these places sell / give away your email address?

freshflowers• 10 years ago

it taught me everything is breached

More likely, sold. Every service that collects user data will get offers, and many can't resist the temptation.

Doesn't matter however, businesses that will sell you to the highest bidder (and in many cases, outside the US, illegally) can't be trusted to ever seriously invest in security. So if they aren't breached, they sooner or later will be.

SixSigma• 10 years ago

Oddly enough I have had the opposite experience.

I have been running per-service emails for 10 years and wonder to myself if it is worth the bother as I can recall only one ever spreading.

Uberphallus2• 10 years ago

My favourite was the unique email I used for a Russian visa application. Either the consulate was ridden with malware, or they just sold my address.

_wp3r• 10 years ago

I would be interested to know if you use a provider or host your own email.

I mention that because most of the ISP do have re-targeting efforts.

Also it would seem more likely that your email provider is breached as opposed to lots of other companies/servers.

inputcoffee• 10 years ago

How do you guys do this? IS there a service? Do you add na.melast@gmail Or do you create them on your own domain through the hosting company?

bad_user• 10 years ago

I also do unique aliases for each account I have. Few of them have been a source of spam.

I also have expiring subdomains. So I'm not using domain.com, but something like b2.domain.com. The rationale is that if I start receiving a lot of spam, I go through all the accounts I have, change all emails to use another subdomain like b3.domain.com, and then invalidate the old subdomain entirely. I haven't had to do that yet and my domain is several years old.

With two big exceptions: the email address I leave on my website and the email address I publish on my GitHub profile. These 2 have dedicated throwaway domains like throwaway283728@domain.com. Because you wouldn't believe how much spam I get from that GitHub profile, not just recruiters, but also get rich offers from princes in Nigeria and Viagra pills.

initram• 10 years ago

Back when I ran a mail server for a small business, I would see the spammers literally going through all the permutations of email addresses for a domain. In the logs you'd see:

failure to send to a@example.com

failure to send to b@example.com

...

failure to send to aa@example.com

etc.

update2• 10 years ago

it taught me everything is breached

Everything is breached. From websites to software to hardware, I would estimate the majority of them can be/have been exploited by advanced hackers.

I'm awaiting the time when we all acknowledge that computers are fundamentally insecure.

Sephr• 10 years ago

I've been using unique-per-service email addresses quite a while, and I maintain a list[1] of all offenders that have leaked my PII.

1. https://gist.github.com/eligrey/5084991

flushandforget• 10 years ago

Good idea.

berlam2• 10 years ago

I also actively watch my unique-per-service email addresses but have not started with a list, yet. Might be a good idea.

neogodless• 10 years ago

That's a much smaller list than I expected. I don't differentiate between those that sold and those that ignore unsubscribe (and a few that just have very contrived unsubscribe systems), but I have over a hundred per-service emails attached to disabled accounts (as aliases) to block them forever.

One that stands out in my head is Cadillac. I had requested a brochure for a CTS, and I got random unrelated spam just days later!

Neil44• 10 years ago

My LogMeIn unique address gets tons of spam - their response was that I must have given it away elsewhere. I no longer use LogMeIn.

Jaruzel• 10 years ago

Same here. I have (at the last count) over 200 website/service specific email aliases. I very rarely use an alias for more than one service. However when I do start getting spam on that alias, and I contact the website concerned they always state it's my fault. My response? If I can, I stop using that website or service.

My dropbox alias email started getting loads of spam about 2 years ago, I immediately junked that account, and set-up a new dropbox account (friends insist on sharing stuff over it...) - my old spammy dropbox alias is in the Dropbox leaked dump, my new current one isn't, which proves that this dump of credentials is from at least before 2015.

prof_hobart• 10 years ago

I do the same, but some companies don't seem to be interested. I've had two different emails linked to a magazine's website and had spam to both.

When I've contacted them about it, they've been absolutely adamant that the spammer must have (twice) guessed the exact email address that I've had there.

oliwarner• 10 years ago

You should report them to their country's data protection body. They are either maliciously selling your data against your explicit wishes or they've been hacked and are ignoring it.

0x02• 10 years ago

I've had the same response. When I ask how come the spammer managed to successfully guess exactly the particular unique email address (including unique hashes appended to the service name as part of the username side of the address) on the first and only attempt (verified by looking at mail server logs), they just shrug.

terraforming• 10 years ago

I use spamgourmet.com for the unique-email-per-service..

Sadly, it doesn't support 2FA.

pingec• 10 years ago

Would be cool to have a service do this automatically and test which services leak email addresses and which don't.

dvcrn2• 10 years ago

unique-per-service email addresses sound indeed interesting. How did you set it up?

I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com?

Do you know of a non-selfhosted provider that is able to do that?

/EDIT: Looks like fastmail, a service many on HN recommended is able to do something similar [0], though if one email gets added into a spam list, it seems to be not possible to remove one particular one.

/EDIT2: Fastmail just confirmed to be on Twitter that it is possible to set individual emails to rejected. Though this requires effectively creating a new alias and setting it to bounce which falls under the account limitations [1], so 600 for a single person account.

[0] https://www.fastmail.com/help/receive/alias-catchall.html

[1] https://www.fastmail.com/help/account/limits.html

richardw• 10 years ago

In Gmail and Apps you can add a +suffix, e.g. dvcrn+hn1@gmail.com will send you mail, assuming your main address is dvcrn@gmail.com.

Gmail also ignores full stops, so you could also use d.v.crn@gmail or dvc.rn@gmail etc.

alnorth• 10 years ago

With Google Mail (and Apps) anything after a + in the first part of the address is ignored, so foo+dropbox@gmail.com would be routed to foo@gmail.com. That's the easiest way to do it that I know of. No need for managing separate aliases.

dividuum• 10 years ago

For gmail, if you have someone@gmail.com, you can just append +anything to your address like this: someone+anything@gmail.com. It will still end up in your mailbox without having to set up anything. See https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...

I would assume that google apps version of gmail offers something similar.

erpellan• 10 years ago

All google email addresses will accept

yourusername+anything@gmail.com

This also works on google apps hosted email domains. You can then use that as part of a filter if you start getting spam to it.

rikkus2• 10 years ago

My email is handled by Google Apps for Business, and I just use e.g. dropbox@hemsley.cc or facebook@hemsley.cc - and have everything come to my real mailbox. Nothing to set up when I want to sign up for a new site. LastPass stores the different email addresses.

This works better than something+realaddress@gmail.com because many sites fail to handle/allow that 'format'.

vtbassmatt• 10 years ago

I used to use https://spamgourmet.com and was quite happy. You can create email addresses on the fly without doing anything in their UI: alias.number.account@spam gourmet.com. Alias is the per-site value, number is the count of emails you want to allow through before automatically routing the rest to /dev/null. I seem to recall an option to remove the numerical limit, too - once you trust the place you gave your address to.

dgoldstein• 10 years ago

Yes but at the time, there was only evidence of password reuse leading to some comprised email lists... Not that password hashes themselves had been stolen. Sigh.

OJFord• 10 years ago

    > Unique-per-service email addresses work pretty well

and they're so easy with Gmail - anything following a '+' character after your username (or alias, if using your own/company domain) will go to the same box, but keep the distinct address.

Unfortunately, depressingly many sites validate email fields, and get it wrong - thinking '+' is not allowed.

IMO it's not even worth trying to get an email regex (or other validation) right - you're probably going to send out an activation email anyway!

midgetjones• 10 years ago

I'm pretty sure they do know a `+` is allowed...

supergreg• 10 years ago

Other services also let you use the alias as a subdomain: example@alias.gmail.com. Wish Gmail added that feature. Do they have any place I can sent a feature request?

Another feature of Gmail is you can place dots anywhere in your email and it will still reach you: ex.am.ple@gmail.com. I haven't seen services that reject that so it is what I use when I can't use a +.

Dayshine• 10 years ago

Except it's really obvious, and spammers can just remove the "+asd" section.

mike-cardwell• 10 years ago

I do the unique address thing, but I also have another system for giving out temporary email addresses. If I want to hand an email address which I know should not receive email after say, this Saturday, I'll just give them "2016-09-03@tmp.grepular.com" - I don't have to do anything to set that up, it will accept mail as long as the date isn't after 3rd September 2016. I blogged it up a while ago here:

https://grepular.com/Automatically_Expiring_Email_Addresses

Esau• 10 years ago

Interesting. I've been considering doing this but, frankly, have been too lazy to implement it. But if you are using a password manager anyway, what's one more field?

lnrdgmz• 10 years ago

On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no...

I've not forgotten, and this glitch has kept me from ever considering opening a Dropbox account.

I'm surprised everyone else seems so forgiving of this massive screw up.

odbol_• 10 years ago

Haha for me it's the opposite. My password never works in Dropbox. I think it's because they don't support spaces in passwords, but they don't tell you when you change your password. They just accept the change and then you can't login.

fapjacks3• 10 years ago

Totally. You wanna talk about people forgetting? It seems everyone has totally forgotten (or forgiven) that Dropbox was mentioned specifically in the Snowden leaks as a source.

cimnine• 10 years ago

I wonder if they got the seeds ('secret key' in [1]) for the 2FA as well.

[1] https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_A...

microtonal5• 10 years ago

This hack precedes the introduction of 2FA on Dropbox:

https://blogs.dropbox.com/dropbox/2012/07/security-update-ne...

raverbashing3• 10 years ago

I wonder why the SHA1s don't have the salt. Were they removed so that only the original owners have it so it's easier to crack?

Oh well, another HIBP entry with my email address...

dbg314153• 10 years ago

Why isn't Dropbox reporting this? I'd have more respect for them if they were more honest about this.

akerro2• 10 years ago

They were preparing to start IPO, so they must be very careful with words they use now.

AjithAntony• 10 years ago

They told us a week ago https://blogs.dropbox.com/dropbox/2016/08/resetting-password...

lloeki• 10 years ago

They sent both me and my wife an email a couple of days ago regarding this, and have a Help Center page[0] for it:

    Hi <first name>,
    
    We’re reaching out to let you know that if you haven’t
    updated your Dropbox password since mid-2012, you’ll be
    prompted to update it the next time you sign in. This is
    purely a preventative measure, and we’re sorry for the
    inconvenience.

    To learn more about why we’re taking this precaution,
    please visit this page on our Help Center. If you have
    any questions, feel free to contact us at
    password-reset-help%dropbox.com.

    Thanks,
    The Dropbox Team

[0]: https://www.dropbox.com/help/9257

dbg314153• 10 years ago

Thanks. Found the email in my junk folder. Cool, glad they sent something.

maaaats• 10 years ago

4 years late, though...

gowthamgts12• 10 years ago

Why these troyhunt guys place a clickbait to hibp in every article? Don't be sick

tonicoto3• 10 years ago

Well, let's reply to the obvious troll.

Troy Hunt is a person, not a team, and I guess he links to HIBP because he's proud of his work. I know I would.

shostack2• 10 years ago

You forgot to add that it is also an incredibly valuable service for times like these that is totally free.

At this point I'd say signing up for notifications with it is just a solid security practice.

pacman143• 10 years ago

Because that is one mans war to help millions who have been pawned.

omginternets• 10 years ago

HIBP says I was pwnd. So ... like ... what do I do now?

SHA-1 hashes should still be okay, right?

dijit• 10 years ago

Change your passwords; especially if you use the same password for many things.

you're not alright, we have a way of knowing if that was your password or not and having unlimited tries with unlimited processing power, which means it's a matter of time before someone is able to guess their way into your accounts.

16556• 10 years ago

Change your password at Dropbox and any sites you re-use that password on (which you really shouldn't be doing).

VeejayRampay• 10 years ago

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical people.

EDIT: Thanks everyone for your answers, this is a good example of the power of communities.

staticelf2• 10 years ago

Unique passwords for each site (I use a password manager) and add two factor auth whenever possible.

Mahn3• 10 years ago

Password manager + two factor authentication whenever possible. As for the former: Opinions here differ but my recommendation would be not to trust a "cloud" password manager and employ an offline password manager instead. KeePass works great for instance and is open source and cross-platform.

tallanvor• 10 years ago

While an offline password manager is inherently more secure, at some point you're either going to have to store the database on a cloud somewhere or worry about constantly keeping your databases in sync. Whether you store it in Dropbox/OneDrive/Google/etc. or use LastPass or another service, there's always going to be some risk.

At present I still recommend LastPass because that way you can easily have everything synced on your computers, phone, etc., and it's easier to convince people to remember one strong password and let LastPass handle remembering all the other strong passwords no matter what device you're on.

m0nty3• 10 years ago

Download a password manager like Keepass, Lastpass or Password Safe:

https://en.wikipedia.org/wiki/List_of_password_managers

I use Keepass, it does exactly what I need.

Secure the password manager itself with a long password. Put your logins into it, and generate a unique random password for each one, then go to the website in question and change the password to the new one.

When you want to login to that website, open your password manager, copy the password to your clipboard and paste it in. Remove the password from the clipboard (Keepass does this automatically after about 10 seconds).

That is ALL you need to do. You could get into using keys, etc, to secure the password manager but if you have a long, unique password for the password manager, it shouldn't be necessary. I'm sure others can provide you with info on how to finesse the process using online password managers, etc, but what I've just described is the basics. Start simple, ramp it up later if you're the paranoid type (which you should be ;)

EDIT: Another thing, if you can use two-factor authentication, do it. I use this on my Google accounts, Paypal and my bank.

https://www.google.com/landing/2step/

https://www.turnon2fa.com/tutorials/how-to-turn-on-2fa-for-p...

Another edit: You can store more in the password manager than just passwords. I keep a scan of my signature in there in case I have to put it into one of those (admittedly insecure) PDF-type forms to "verify" I've signed something. I also make up stupid answers to password hint questions and these also go in the password manager, e.g. "First school" -> "Dr Magnus Pike's School for Aspiring Arsonists". Too easy for people to work out what my real first school is called.

neltnerb• 10 years ago

Yeah, I've been doing that same thing with security questions, except I just generate a new random password for each. I really wish that field was automatically blocked from view without the master password like the passwords themselves are when you toggle that (excellent) option.

tajen• 10 years ago

Is Keychain Access from OSX a safe password manager?

Also, how comes all security-aware people trust 1Password and LastPass, even though they are not open source? Isn't that one of the rules of security, publish the source so we can trust it?

djsumdog2• 10 years ago

I really dislike password managers and there's good news: you don't need one to have unique password per site. A good password algorithm is very useful:

http://penguindreams.org/blog/my-accounts-been-hacked-no-it-...

The article is dated. I'd suggest a longer minimum and 2 factor for services that support it. The advantage is unique passwords that you don't have to look up.

Mahn3• 10 years ago

I used to do this before switching to a password manager; the problem with pattern-based passwords is that while in paper it sounds better than password reuse (unique passwords for each site/service while still being able to remember them, yay!) in practice you are still using the same pattern for all of them. A potential smart adversary could figure out the pattern used and then apply it to every site/service much like if the password was reused. E.g., if your facebook password is "j0hnf4c3b00k83", an adversary could easily guess that you are using a site/service pattern, and that your google password is "j0hng00gl383".

Of course, the pattern doesn't have to be that simple, but even if it were incredibly complex, at the end of the day you are still relying on one single pattern for all your passwords.

atmosx• 10 years ago

I use 1Password and I'm fairly happy with it. I also use dropbox for sync, since other methods suck. I didn't had a Dropbox account in 2012 so I'm not sure if I'm affected, but anyway, my 1Password chain should be secure even if stolen/accessed... That's what encryption is all about anyway.

timdeneau• 10 years ago

I’ve always been under the impression the most secure and (technically) simple solution is to use the local system, like Keychain Access.

I wrote a small program that generates a list of random passwords. I just open terminal and type password, then copy/paste one of the outputs and allow Keychain Access to remember it. I do this for every service, the only manual password I use is for my actual computer, which is rotated periodically. You’ll need to manually backup your keychain file though.

This isn’t a friendly solution for most people.

ss64• 10 years ago

http://ss64.com/pass/ Download the page to your desktop and you can use it offline.

sureshn• 10 years ago

Recently I had received an email from Dropbox asking me to change my password and now I read about the hack , I wonder if there is any correlation here.

jbverschoor• 10 years ago

How can I tell if someone has accessed my account / files?

oxplot• 10 years ago

Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.

shostack2• 10 years ago

Can't upvote hard enough. Also, it is shocking how bad security is for all these games I've played over the years. The publishers seem to be the source of the vast majority of these leaks I've been caught in.

Thankfully the notification emails from this service are prompt and helpful (not to mention totally free).

thieving_magpie• 10 years ago

Also note the guy that runs it is the one that wrote this article.

rajathagasthya• 10 years ago

Wow, thanks for this. I just found out that my email address was breached 3 times, while only one company sent an email informing me of the breach.

hatsix• 10 years ago

Also, LastPass uses a similar site, plus it's specific knowledge of your passwords (last time it was changed), to let you know if a password has been compromised.

Not sure if 1Password does as well, but it seems like a fairly obvious feature to add.

irq• 10 years ago

It does.

cmg• 10 years ago

1Password has a "Watchtower" feature that "identifies websites that are vulnerable to Heartbleed". Also under Security Audit are sections for Weak Passwords, Duplicate Passwords, and groupings of password ages (3+ years old, 1-3 years old, 6-12 months old for me). It does not appear to keep track of leaks/hacks.

https://watchtower.agilebits.com/

thwarted2• 10 years ago

I'm not sure how much I can trust the results of a site that claims an email address I only use for one site has been breached on sites and services I've never been to. However it's calculating if what you enter into the form appears in the leaked content sure gives a lot of false positives.

Which I suppose forces more awareness, but it doesn't instill a lot of confidence.

wyldfire• 10 years ago

I think false positives like this are worth reporting upstream.

FWIW I was subscribed and didn't get anything until this most recent breach. Unfortunately GMail thought it was spam (speaking of false positives!).

harlanlewis• 10 years ago

A false positive from your perspective doesn't mean your email address isn't actually being used to sign up for things.

My primary personal email address is routinely used by a small handful of other real people (all strangers) for all sorts of things - college applications, car insurance, some address books think it belongs to a cousin who gets included in a lot of group threads about reunions and full of photos. I've found the families more difficult to unsubscribe from than the services, name+email associations spread like a virus. I routinely get alarming/misleading "Someone has your password!" security alerts from Google after someone tries to list my email as a backup account.

These little strings we use to identify ourselves can be typed by anyone, anywhere, bot or human. I wouldn't worry too much about false positives.

edraferi• 10 years ago

From https://haveibeenpwned.com/FAQs :

Why do I see my username as breached on a service I never signed up to? When you search for a username that is not an email address, you may see that name appear against breaches of sites you never signed up to. Usually this is simply due to someone else electing to use the same username as you usually do. Even when your username appears very unique, the simple fact that there are several billion internet users worldwide means there's a strong probability that most usernames have been used by other individuals at one time or another.

snowwrestler• 10 years ago

Its worth pointing out that other people can use your email address to create accounts. It's just a string of characters to type in.

They might not even know it's yours, like if your email is davidsmith@gmail and they fat-finger davidrsmith@gmail--boom, "you" now have an account.

Good services use double-opt-in to ensure that every account is actually tied to a correct and working email address. But not every service does this.

And even services that do use double opt-in would create a row in their database to note that a confirm email was sent out. If they never scrub those invite rows, "your" email address would still be in the DB when it's exfiltrated, even if the confirmation process was never completed.

SerialBusiness• 10 years ago

Damn, thanks for this. It seems that I've actually been pwned at some point.

netule• 10 years ago

This was a strange way to find out that I have a Tumblr account.

the_watcher• 10 years ago

Exactly my reaction.

loeg• 10 years ago

Myspace and Adobe, neither of which is present in my password manager. Huh, no memory of those.

nissehulth• 10 years ago

Lol, that was my initial thought too. Also, I obviously once had an account on vBulletin.

_h8ft• 10 years ago

I think there was a time when it was once considered a vaguely normal blogging platform.

narutouzumaki• 10 years ago

Haha same here.

DavideNL• 10 years ago

true... but unfortunately in this case (Dropbox) you would have gotten a notification about 4.5 years later ;-)

nstj2• 10 years ago

Fun fact: Have I Been Pwned neither salts nor hashes the creds which it stores on its website, potentially making itself an interesting target for hackers[0]

[0] http://risky.biz/RB388

TazeTSchnitzel• 10 years ago

HIBP doesn't store passwords, it only stores usernames and email addresses.

tamana• 10 years ago

HIBP hosts only completely Public alread leaked data -- that's how they source their data

garaetjjte• 10 years ago

I think it should hash entered email client-side in JS to be more trustworthy. I am a bit worried about giving my various email addresses to some random site.

corobo3• 10 years ago

If you don't trust it to keep your email safe why would you trust it when it says it's going to hash your address?

Also it's an email address, not your credit card number.

smsm422• 10 years ago

Ironically, https://haveibeenpwned.com certificate is signed by StarCom, which is the same as WoSign https://news.ycombinator.com/item?id=12411870 which means it basically trusts a known scammer to provide its security and one should not be giving this site any information you don't want to see in public.

chinathrow2• 10 years ago

Great read.

He goes on to say that 1Password has a subscription now and that you should signup for it.

No. I will never, ever put all my passwords into a cloud based password store. I simply do not trust them to not fuck it up at one point in time.

Am I alone with this view?

aianus• 10 years ago

1Password is not cloud based...

chinathrow2• 10 years ago

https://1password.com/privacy/

For some products, they are.

"Your vaults, items, and documents are fully encrypted in your 1Password Families and 1Password Teams and stored on our servers."

martin-adams2• 10 years ago

If find this just interesting that just last week my steam account was successfully logged in from Russia (I'm in the UK). Looks like I forgot about Steam to make my passwords stronger.

andypants• 10 years ago

I turn on 2FA wherever I can now. If only steam supported modern 2FA and not sending a code via email.

martin-adams2• 10 years ago

Agree. If they support Google Authenticator, even better. Sometimes the text messages don't come through.

blakeyrat• 10 years ago

They do-- IF you own an Android or iOS phone. If you own a Windows Phone, you're just screwed.

Ffaine• 10 years ago

I've never trusted dropbox, cloud etc. They drive me paranoia. :/

zaroth• 10 years ago

As for Dropbox, they seem to have handled this really well.

I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2].

In 2012 they did not disclose that hashes were stolen, so I don't see how it's really relevant. In the latest communication, they don't actually explain the risk to the user. They say it is "purely as a preventative measure" but if salts and hashes were accessed, then that is not the case.

Just because Troy doesn't have access to some of the salts, doesn't mean the attacker doesn't have access. We don't know how many iterations of SHA-1, but SHA-1 can be run by a single GPU on the order of billions of times per second. So unless Dropbox is coming out and saying they know for certain that random 128-bit salts were definitely not accessed by the attacker, almost all of the SHA1 hashed passwords are getting cracked. Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised.

As for the salted/bcrypt passwords, we can see from Troy's hash they used $2a$08$ which is bcrypt with a cost factor of 8 -- 2^8 iterations. Gosney's latest rig [3] could crack these bcrypt hashes at about 105,700 / 8 = 13,212 per second. That's not terrible, but that's still 416 billion tries in a year for a modest investment.

[1] https://blogs.dropbox.com/dropbox/2012/07/security-update-ne... [2] - https://blogs.dropbox.com/dropbox/2016/08/resetting-password... [3] - https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

Xylakant• 10 years ago

> As for Dropbox, they seem to have handled this really well.
I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2].

Especially given that 2012 they assured me that no credentials were lost and this time they didn't even inform me since my account was deleted in the mean time. So it's more or less luck that I know that my old password was compromised.

ethicalhack3r• 10 years ago

See my comment here: https://www.reddit.com/r/netsec/comments/50ggbn/the_dropbox_...

nxzero2• 10 years ago

> "Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised."

This should be assumed regardless of what is known if it's know a breach happened; meaning basic password hygiene should be followed, and I'm the case of Dropbox, if a user had any plaintext files with passwords to other accounts (yes, people still do this) - they need to change those passwords too.

psook3• 10 years ago

Right, but you're assuming optimal response from every Dropbox user, when I'd assume the vast majority of Dropbox users aren't aware of best password practices (or are aware and only change passwords when forced anyway because 'I have nothing to hide'). The severity of the breach means Dropbox should be forcing password changes. I didn't even receive an e-mail notifying of the breach. Nothing in the spam filters, it's just not there. The only reason I'm aware of it is Troy Hunt, and the only reason I'd ever be aware of it is that. I was getting ready to leave dropbox anyway, this just reasserted that it's the correct decision.

erikb2• 10 years ago

I don't remember the details, but I remember that it was really awful how they handled it back in 2012. Really thought about dropping them (small pun intended). I am very happy to see that they got better, but am still a little sceptical.

arprocter• 10 years ago

The email they sent out completely neglects to mention that there was a breach unless you follow a link:

"We’re reaching out to let you know that if you haven’t updated your Dropbox password since mid-2012, you’ll be prompted to update it the next time you sign in. This is purely a preventative measure, and we’re sorry for the inconvenience.

To learn more about why we’re taking this precaution, please visit this page on our Help Center. If you have any questions, feel free to contact us at password-reset-help@dropbox.com"

summarite• 10 years ago

Horrible communication, much more important than to force a change on the site itself is to say to all users: look, your passwords are at risk, if you reused them change them now. All that in a way that non-techies can understand. Else we can all just wait for the millions of compromised accounts.

vladimir-y• 10 years ago

btw Argon2 https://github.com/P-H-C/phc-winner-argon2 is better than bcrypt for passwords hashing

watson• 10 years ago

What really bothers be about this is that Dropbox hasn't bothered to reset the sessions. Even after I manually reset my password (which I wasn't prompted or forced to do btw), all my apps (iPhone, desktop etc) that have existing sessions wasn't expired. So for all I know, a hacker might already have an open session to my Dropbox and changing the password will not fix that

Clarification edit: I did receive the e-mail from Dropbox letting me know that I should change my password, but when visiting dropbox.com I was already logged in and wasn't prompted to perform the pw reset

sfilipov• 10 years ago

You can see all the existing sessions and authorised applications from their website. It is not perfect and it is extra work to go through those and delete them, but at least there is a way.

aantix• 10 years ago

https://www.dropbox.com/account#security

Unlink the device to restart the session.

gwbas1c2• 10 years ago

I'm a lead at Syncplicity, a prominent competitor. Early in my career at Syncplicity I changed all of our desktop clients to use long-lived sessions that do not reset when the user's password is changed.

For us, this is deliberate for a few reasons. Most of our customers authenticate via their employer's SSO (single sign on) and do not use any Syncplicity password management. We also do not believe that routine password maintenance should force someone to run around and re-authenticate all their computers. (Like Dropbox, a user can log into our web site and remove computers from their account.)

I do understand the argument that a password change should force a re-authentication on all clients; but I don't think it's the right approach. Changing a password is reactionary and preventative. An email notification will inform a user that his or her account is compromised.

erikb2• 10 years ago

Maybe one could add a checkbox to allow users to do that when they want to. My Skype password was recently hacked and I'm very very happy that I could via one command logout all the clients. Sometimes it's a feature you really really want to react fast.

e40• 10 years ago

Is there a way to force the clients to be disconnected? I'm not a customer of you or dropbox.

mordocai• 10 years ago

Personally I like a "revoke all clients" button in addition to the system you describe.

nicholasjon• 10 years ago

I recently unlinked all my Dropbox sessions that were older than one month, which was a staggeringly high number to tell the truth. It would have been nice (and faster!) to have had a "panic button" that let me unlink everything all at once and only relink the things I needed to relink.

sordidfellow• 10 years ago

So we finally get validation of https://news.ycombinator.com/item?id=5300492

lllorddino• 10 years ago

1Password now has a subscription service for $3 a month and you get the first 6 months for free.

Don't pay for this people. Use the open source password manager Keepass http://keepass.info/

kumarski• 10 years ago

the website is so poorly designed, it leads to consumer-non-adoptability.

vog• 10 years ago

Indeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine.

On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, whose URL is as complicated as: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h...

wepple3• 10 years ago

I love and use 1password, but to be honest I can't see any 'pro' features that I need/want:

https://support.1password.com/pro-features/

jonknee3• 10 years ago

1Password is well worth the money. It is well designed for both desktop and mobile and I am happy to pay for software that I use every day.

dimino6• 10 years ago

It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party, but are not okay reusing a password somewhere.

If 1Password ever got owned, the Internet would be severely fucked.

And to stem the potential flood a bit, I realize there are plenty of good counterargument built up over the years to try and combat this general idea, but fundamentally the concept of giving your password to someone else to manage is still a confounding idea, regardless of whatever points those arguments make.

cpach• 10 years ago

So besides resetting the password, should one also unlink devices and apps?

evan_3• 10 years ago

You should probably audit the list and disconnect any you don't recognize, but you should probably be doing that periodically anyway with everything...

Joof• 10 years ago

What's the big deal? It's not like it allows attackers to directly modify files on anyone's computer if they have Dropbox installed.

StanislavPetrov2• 10 years ago

It never ceases to amaze me how people have bought into "cloud" computing. Its hard enough to protect your own data, on your own secure machine. Once you entrust your data to a third party you should have absolutely no doubt that it is at risk. The larger the organization that that third party is, the more inherently insecure it is. In the cloud, it only takes one careless, stupid, or inept person to expose the data of thousands (or millions). And you can't fix stupid.

No thanks, I'll keep control over my own data.

fastball3• 10 years ago

I guess it depends on the data we are talking about?

I have a huge photo library, but I'm not a professional photographer. I'm not going to sell any of the photos I have on my computer. So when Apple told me I could offload all that data to the cloud, and worry about it less (from a backup perspective), I said "absolutely".

Sensitive data is more problematic. But the vast majority of people aren't handling "sensitive" data.

StanislavPetrov2• 10 years ago

I guess it depends on the data we are talking about?

Absolutely it depends.

But the vast majority of people aren't handling "sensitive" data.

I don't think that is necessarily true, but it would depend on how you define "sensitive". If you are storing data in the cloud that you are happy sharing with the public, then security isn't an issue. However, many people backup all of their data in the cloud (you need look no further then OneDrive that comes with every copy of Windows 10). This includes their financial information, tax returns, intimate personal information, and other things that would horrify them if they were exposed to the public. Most do so without understanding the risks because cloud computing has been sold so heavily by the government, corporations, and media outlets.

And we aren't just talking about individuals. Many, if not most, corporations use cloud computing to store their data. This includes financial data, customer information, credit cards, account numbers, and everything else you can imagine.

I'm not trying to argue cloud computing doesn't have its uses. I have no problem using the Steam cloud to save my game in Civilization 5, regardless of how insecure their servers are. But the risks are very real any time you entrust your data (or anything else) to a third party, and they should be recognized.

danso• 10 years ago

Well, thank goodness I got robbed after 2012, which caused me to change all my passwords everywhere. Else I don't think I would've ever gotten around to changing my Dropbox password, as it's just a long string of randomness.

achr24• 10 years ago

Dropbox should absolutely be held to the flame for trying to downplay the severity of this. Their communication says 'This is purely a preventative measure', but if you had/have reused this password on any other sites (let's face it a huge proportion of non tech savvy people do this) then your entire online presence may be exposed.

Swizec2• 10 years ago

Non tech savvy? Everyone does this. It's practical.

Sure most of us have a few passwords we reuse, but I know less than 5 people with truly unique passwords.

ksenzee• 10 years ago

No, lots of people use password managers. You should try one.

dsacco2• 10 years ago

Considering the consequences of password breaches, it's decidedly impractical. Password managers make it very easy to have unique passwords for all websites.

I don't even know any of my passwords.

duaneb• 10 years ago

I'd argue with a password manager it's more pragmatic to have a different password everywhere. I know two passwords and use my manager for everything.

em3rgent0rdr• 10 years ago

Anyway, tech-savvy folk are more likely to setup their own file-sync server. It is the non-tech-savvy people who are the primary users of dropbox.

pault2• 10 years ago

Use an algorithmic password. Pick some easy to remember keyword, then work some of the letters of the website into the password so each site is unique. For example, your seed could be "horse", and your gmail password would be something like "hgomrasiel". I've been doing this for ten years and haven't forgotten a password yet. :)

gshulegaard• 10 years ago

Genuinely curious, but what do you think the severity is?

Everything I know about it (this article included) places the Dropbox leak very low in my sense of severity.

landr0id• 10 years ago

The first time I saw the email I believed that Dropbox was taking it as a preventative measure because they thought they were breached -- not that they were breached. This information as hidden behind the link to more information in the email itself.

achr24• 10 years ago

The severity stems from the unfortunate fact that a password leak retroactively, and silently, destroys your security across all sites that use the same or a similar password. Even if you started using the longest, randomised, two-factor-authenticated password system last year, all those forgotten or seemingly unimportant accounts are suddenly exposed.

Even when the exposed sites have minimal information or impact, minor information in aggregate adds up to a lot of danger for escalation and social engineering.

Now consider that there are huge swaths of people with the same password that they've use for email, banking, medicare, and everything else.

A proper response from Dropbox would be to explicitly and loudly inform every leaked email address (not just their current users) that they need to immediately change every password across any and all sites that might use the same leaked credentials.

Furthermore, Dropbox should set up a secure site with a unique link per email address that allows a user to key-in and check their memory against the exposed hash. I know that I have changed my password for Dropbox at least twice since 2012, but in 2012 I might have used an insecure password. Allowing me to figure it out before a nefarious party would allow me to better judge the potential personal impact.

wepple3• 10 years ago

did dropbox ever write up the details of how they were compromised and what else the attackers may have taken?

If not, there's nothing to suggest they didn't take other things.

maherbeg4• 10 years ago

What sites does everyone have two step verification on? I'm trying to figure out where I need to setup two step verification that also accounts for a phone being stolen/lost.

Between gmail, dropbox (1password is synced here), and apple, I'm not sure where I should be enabling it. It seems like everywhere but gmail and apple is probably the right move...

evan_3• 10 years ago

Enable it everywhere you can, and just write down & guard the backup keys.

Also, I don't use it, but 1password can store and backup 2FA keys so you can theoretically recover from a lost phone that way, depending on how you store the 1password vault. Not a replacement for backup keys necessarily.

maherbeg4• 10 years ago

Generally agree here, but I'm thinking about real scenarios in which I may never be able to recover anything.

One scenario is traveling abroad and having my phone stolen/lost.

dmd• 10 years ago

Me: Google Github Dropbox Dreamhost Amazon (store) Amazon (AWS) Microsoft RamNode Twitter Apple Facebook

Why wouldn't you enable it on Google and Apple? Those seem like the most important. You print out the backup codes and keep them safe.

maherbeg4• 10 years ago

I definitely want to enable it on the most important accounts, but I worry about the scenario where I lose my phone/wallet when traveling abroad.

jorblumesea• 10 years ago

Funny, I just got an email a week ago saying they had noticed my password hadn't been changed in awhile (2012, which was interesting based on the article). Sounds like they knew about this and beefed up security.Or, they beefed up security on newer passwords but didn't cut over the old ones? The email did not mention any data theft, kinda wish it did. Too little, too late.

gjolund• 10 years ago

Use unique passwords ffs.

randyrand• 10 years ago

How is it possible for Hashcat to crack a 20 character long random password in 6ms? That is mind boggling.

I thought he was just going to hash the password and see if it fit the leaked hash, but no, it looks like he actually did the reverse and cracked the hash to see if it fit the password, right?

Edit: oh it looks like he provided the password to hashcat in the form of a psudo 'dictionary' to use. So Hashcat was not really cracking it - just iterating through a 1 word dictionary - like he said.

marco12• 10 years ago

No, he didn't crack it but just hashed it and checked for equality. So just what you would have expected.

He did it in a way that appears more complicated to people using Hashcat not as often as he probably does.

Hashcat used the real password as a single-entry password dictionary. So in order to "crack" the hash, it grabbed the first and single entry from its dictionary, hashed it, ... match!

Don't worry, this has been confusing to me and several people in the comments section on his website as well.

update2• 10 years ago

I'm surprised no one has mentioned Dropbox's bug bounty program: https://hackerone.com/dropbox

You have to wonder if all those grumbling whitehats were on to something when they said bug bounties should pay a lot more than what they do and that there IS a black market interest for them.

nevi-me• 10 years ago

I suppose this is off topic, but I checked one of my email addresses on https://haveibeenpwned.com/ and found a LinkedIn hack from May 2016.

Thing is I've deleted my LinkedIn account thrice in 2013. They have no right to stop have my email after that long.

manishyt2• 10 years ago

The hack is from September 2012. LinkedIn knew about it in May 2016.

mjmasn• 10 years ago

Hmm, my account appears on HIBP, but Dropbox haven't asked me to change my password on login... Who to believe? (probably not Dropbox)

tannerh• 10 years ago

Tannerah@gmail.com

ommunist• 10 years ago

OK. Thank you, HN. I just discovered that I've been pwned on Dropbox breach. If that happened in 2012, and I am using 1Password sync over Dropbox, does that mean that all my passwords stored in 1Password.pif in 2012 were compromised too? Probably yes.

The Dropbox hack is real

Related Stories