Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

91–100 of 557 posts

Re: The Dropbox hack is real

#91

Post by staticelf »

VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

Unique passwords for each site (I use a password manager) and add two factor auth whenever possible.

Re: The Dropbox hack is real

#92

Post by rtpg »

wrboyce wrote: post #69
donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now. The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which…

a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely

I would recommend testing theories of :

- losing phone

- losing computer

- losing both

and have reasonable backup strategies for these scenarios.

Re: The Dropbox hack is real

#93

Post by jmknoll »

CookieMon wrote: post #80
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

> giant iceberg of pwnage floating beneath the surface out of view

Very poetic. I'd like to see this made into one of those motivational posters and hung in the office of every dev team nationwide.

Re: The Dropbox hack is real

#94

Post by oliwarner »

prof_hobart wrote: post #90
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

I do the same, but some companies don't seem to be interested. I've had two different emails linked to a magazine's website and had spam to both. When I've contacted them about it, they've been absolutely adamant that the spammer must have (twice) guessed the exact email address that I've had there.

You should report them to their country's data protection body. They are either maliciously selling your data against your explicit wishes or they've been hacked and are ignoring it.

Re: The Dropbox hack is real

#95

Post by epimenov »

donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

1Password can do 2FA, also syncs between all your devices. And no trusted 3rd party cloud service.

Re: The Dropbox hack is real

#96

Post by ashitlerferad »

mrsirduke wrote: post #19
ashitlerferad wrote: post #8

Earlier quoted context omitted.

Public-key crypto. Client side X.509 certificates for the web. S/MIME and OpenPGP keys for email. OpenSSH keys for SSH. etc

We tried using X.509 certificates in Denmark for proving your identity to the state. It was a complete nightmare unless you understood what public key crypto is, how it works, and how to configure your browser for it. Don't get me started about having to move your certificate/keys around. It doesn't work for the masses.

So when are the browser vendors going to fix their interfaces?

Re: The Dropbox hack is real

#97

Post by gtufano »

whyagaindavid wrote: post #59
emillon wrote: post #21

Earlier quoted context omitted.

It's a common feature of password managers.

Honest question: Why does any none need password managers? Does not chrome password sync or firefox sync do the job? Thanks

Some of us still use native applications that don't use Chrome or Firefox.

Re: The Dropbox hack is real

#98

Post by jethro_tell »

bluejekyll wrote: post #65
ascorbic wrote: post #48

Earlier quoted context omitted.

If you use a YubiKey then you can move tokens between devices without needing to trust a third party, nor worry about them somehow being exfiltrated from your phone. https://www.yubico.com/

Has anyone had yubikey fail? I have one on my keychain, never an issue in years, but I can't help but be concerned, one day, I will be locked out...

I just have two, if you're doing strictly u2f they are less than $20. I have a nano4 and a neo that I use for u2f, oath tokens, and rsa keys for sign/encrypt/auth. It's not the cheapest setup but it's highly functional and about the best account security I could put together. I lost a gmail account for 45 minutes once and decided that would be much worse then the cost of the keys.

Re: The Dropbox hack is real

#99

Post by staticelf »

peteretep wrote: post #25

Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?

Switch to SpiderOak: https://spideroak.com/

Re: The Dropbox hack is real

#100

Post by 8draco8 »

willvarfar wrote: post #56
mmaunder wrote: post #28

Earlier quoted context omitted.

The salts for the sha1 passwords weren't leaked. So they're hard to crack in practical terms. Depends how random they were. See hashcat docs and benchmarks for complete answers to your questions. The GPU versions of hashcat.

I actually googled before asking my question, and couldn't come up with a good feel for just how crackable these are with hashcat... I guess I don't know the terms or the prices. Is anyone able to make any sense of the GPU hashcat benchmarks that are posted? Something distilled down to "if you spend $xxx, then you can crack any salted sha1 under 12 letters+digits+punctuation in n hours if you knew the salt; if its bc…

Hash can be stored somewhere else. I also saw systems where some kind of constant for the user was used as a salt. For example first 5 characters of username or timestamp of registration.
Post reply on HN