The Dropbox hack is real

#1

Post by joshschreuder » Wed, Aug 31, 2016, 6:13 AM UTC

Re: The Dropbox hack is real

#2

Post by jsmthrowaway » Wed, Aug 31, 2016, 6:36 AM UTC

Repeating from the other thread:

I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance.

HIBP is a truly essential service and I'd be happy to pay more. Even with good password discipline it's useful knowledge on your exposure and I cannot recommend it enough. He mentions it near the end but this is one of those no brainers that should be repeated very loudly.

https://haveibeenpwned.com

Re: The Dropbox hack is real

#3

Post by djhworld » Wed, Aug 31, 2016, 6:50 AM UTC

jsmthrowaway wrote: post #2

Repeating from the other thread: I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance. HIBP is a truly essential service and I'd be happy to pay mo…

Thanks for linking to this site, it says my address was breached in Dropbox, LinkedIn, Gawker media(?) and Tumblr

I changed my Dropbox password last week after they sent the email, same with LinkedIn.

Great site though

Re: The Dropbox hack is real

#4

Post by ashitlerferad » Wed, Aug 31, 2016, 6:54 AM UTC

jsmthrowaway wrote: post #2

Repeating from the other thread: I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance. HIBP is a truly essential service and I'd be happy to pay mo…

It really is about time we stopped using passwords.

Re: The Dropbox hack is real

#5

Post by markild » Wed, Aug 31, 2016, 6:59 AM UTC

ashitlerferad wrote: post #4

jsmthrowaway wrote: post #2

Repeating from the other thread: I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance. HIBP is a truly essential service and I'd be happy to pay mo…

It really is about time we stopped using passwords.

Honestly curious, what should we use?

Re: The Dropbox hack is real

#6

Post by donw » Wed, Aug 31, 2016, 7:01 AM UTC

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well.

I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices.

For your critical services, keeping encrypted copies of your backup codes is a must.

Re: The Dropbox hack is real

#7

Post by [deleted] » Wed, Aug 31, 2016, 7:02 AM UTC

ashitlerferad wrote: post #4

jsmthrowaway wrote: post #2

Repeating from the other thread: I highly recommend Troy's HIBP service, hiding your e-mail from showing up in public searches (important for opsec), and donating whatever you can to Troy. He's doing excellent work. This is the first time it's notified me and it was great, because I completely forgot I signed up. I appreciate a service that low maintenance. HIBP is a truly essential service and I'd be happy to pay mo…

It really is about time we stopped using passwords.

[deleted]

Re: The Dropbox hack is real

#8

Post by ashitlerferad » Wed, Aug 31, 2016, 7:04 AM UTC

markild wrote: post #5

ashitlerferad wrote: post #4

Earlier quoted context omitted.

It really is about time we stopped using passwords.

Honestly curious, what should we use?

Public-key crypto. Client side X.509 certificates for the web. S/MIME and OpenPGP keys for email. OpenSSH keys for SSH. etc

Re: The Dropbox hack is real

#9

Post by TTPrograms » Wed, Aug 31, 2016, 7:04 AM UTC

donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

Note the hack was in 2012. Hopefully most people have rotated passwords by now.

Re: The Dropbox hack is real

#10

Post by voltagex_ » Wed, Aug 31, 2016, 7:05 AM UTC

donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

I still feel squeamish about Authy having all the tokens - what happens when they get breached?