Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

171–180 of 557 posts

Re: The Dropbox hack is real

#171

Post by nicky0 »

cm2187 wrote: post #75
jsmthrowaway wrote: post #64

Earlier quoted context omitted.

I have my 2FA in Notification Center and consider this fine given that it's second factor. With that, it's about eight seconds for me involving one slide of my finger. I'm also mystified that you think support for 2FA and mandatory 2FA are the same thing, particularly for something like Netflix.

I am not arguing about support vs mandatory. Just that I am not convinced 2FA is a compeling alternative. At least the way I see it implemented. I like the idea behind SQRL, which still requires another device, so still inconvenient, but at least it does not rely on the server sending a message through a slow protocol. The website displays a QR code, you launch an app, scan the QR code, this app connects to the serve…

2FA doesn't have to be done over email/SMS. Nearly all websites these days support Google Authenticator protocol enabling use of a wide race of app/devices (for example my Garmin watch) to produce the code. No need to wait for an email/SMS.

Re: The Dropbox hack is real

#172

Post by Mahn »

tallanvor wrote: post #141
Mahn wrote: post #103

Earlier quoted context omitted.

Password manager + two factor authentication whenever possible. As for the former: Opinions here differ but my recommendation would be not to trust a "cloud" password manager and employ an offline password manager instead. KeePass works great for instance and is open source and cross-platform.

While an offline password manager is inherently more secure, at some point you're either going to have to store the database on a cloud somewhere or worry about constantly keeping your databases in sync. Whether you store it in Dropbox/OneDrive/Google/etc. or use LastPass or another service, there's always going to be some risk. At present I still recommend LastPass because that way you can easily have everything syn…

Sure, with an offline password manager backups and synchronization are up to you, but even if you end up relying on cloud storage it's a different story; for instance, if you store your KeePass database on a Dropbox account and said Dropbox account gets breached, at least you know that unless there's a flaw in the encryption algorithm used by KeePass, the password database cannot be decrypted without the master password (and brute forcing it should be very impractical if the master password is good enough).

If you use service like LastPass or 1Password you can never be entirely certain that a breach or a security flaw in any of these services isn't going to expose your passwords. I'm sure they use the proper encryption measures, but like the Dropbox breach shows, shit happens and companies get hacked.

I'm not saying never use a cloud password manager, but understand that the added convenience comes with added risk; I would definitely not make my company depend on them.

Re: The Dropbox hack is real

#173

Post by syshum »

stfnfhrmnn wrote: post #164
cm2187 wrote: post #77

Earlier quoted context omitted.

Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.

I also use a Unique-per-service email address with Paypal, and I noticed that Paypal actually passes on that email address to the retailer when I pay with Paypal. I receive order confirmation emails (from those retailers) and quite a few unwanted newsletters to my unique paypal address now. I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. I always have to enter a separ…

>>>I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data.

For years the Paypal API sucked, and even today their are many companies that do not have full integration with paypal, so this is a way to match payment records as for 99% of shoppers the email address for the order/account will match the paypal email address.

Re: The Dropbox hack is real

#174

Post by DominikSerafin »

chii wrote: post #162
have_faith wrote: post #143

Earlier quoted context omitted.

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just re…

Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...

What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.

Re: The Dropbox hack is real

#175

Post by cm2187 »

chrisseaton wrote: post #121
cm2187 wrote: post #77

Earlier quoted context omitted.

Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.

> the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.

Chip and pin is not for online transactions, but in-store transactions. The merchant can see your credit card and would often manipulate it themselves.

Re: The Dropbox hack is real

#176

Post by jbrooksuk »

dividuum wrote: post #147
dvcrn wrote: post #137

Earlier quoted context omitted.

unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastm…

For gmail, if you have someone@gmail.com, you can just append +anything to your address like this: someone+anything@gmail.com. It will still end up in your mailbox without having to set up anything. See https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo... I would assume that google apps version of gmail offers something similar.

Also, iCloud allow this.

Re: The Dropbox hack is real

#177

Post by freshflowers »

CookieMon wrote: post #80
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

> it taught me everything is breached

More likely, sold. Every service that collects user data will get offers, and many can't resist the temptation.

Doesn't matter however, businesses that will sell you to the highest bidder (and in many cases, outside the US, illegally) can't be trusted to ever seriously invest in security. So if they aren't breached, they sooner or later will be.

Re: The Dropbox hack is real

#178

Post by throwanem »

stfnfhrmnn wrote: post #164
cm2187 wrote: post #77

Earlier quoted context omitted.

Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.

I also use a Unique-per-service email address with Paypal, and I noticed that Paypal actually passes on that email address to the retailer when I pay with Paypal. I receive order confirmation emails (from those retailers) and quite a few unwanted newsletters to my unique paypal address now. I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. I always have to enter a separ…

Paypal is great at that kind of unintentional disclosure. Six or eight years back, because I liked what she had to say, I used it to donate to someone who was then speaking under a pseudonym as a result of some fairly credible threats. Imagine my surprise when, in the process of transferring funds, Paypal showed me her full legal name and domicile address in the UI!

Of course I let her know about it, and I seem to recall her saying she'd addressed it successfully, but if she described how, I no longer remember. It quite astonished me that this was even a thing that could happen, though. One hopes it no longer does.

Re: The Dropbox hack is real

#179

Post by shostack »

oxplot wrote: post #109

Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.

Can't upvote hard enough. Also, it is shocking how bad security is for all these games I've played over the years. The publishers seem to be the source of the vast majority of these leaks I've been caught in.

Thankfully the notification emails from this service are prompt and helpful (not to mention totally free).

Re: The Dropbox hack is real

#180

Post by Mahn »

djsumdog wrote: post #111
VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

I really dislike password managers and there's good news: you don't need one to have unique password per site. A good password algorithm is very useful: http://penguindreams.org/blog/my-accounts-been-hacked-no-it-... The article is dated. I'd suggest a longer minimum and 2 factor for services that support it. The advantage is unique passwords that you don't have to look up.

I used to do this before switching to a password manager; the problem with pattern-based passwords is that while in paper it sounds better than password reuse (unique passwords for each site/service while still being able to remember them, yay!) in practice you are still using the same pattern for all of them. A potential smart adversary could figure out the pattern used and then apply it to every site/service much like if the password was reused. E.g., if your facebook password is "j0hnf4c3b00k83", an adversary could easily guess that you are using a site/service pattern, and that your google password is "j0hng00gl383".

Of course, the pattern doesn't have to be that simple, but even if it were incredibly complex, at the end of the day you are still relying on one single pattern for all your passwords.

Post reply on HN