The Dropbox hack is real

Post by Spooky23 » Wed, Aug 31, 2016, 12:53 PM UTC

cm2187 wrote: post #40

0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Post by supergreg » Wed, Aug 31, 2016, 1:00 PM UTC

OJFord wrote: post #196

0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well and they're so easy with Gmail - anything following a '+' character after your username (or alias, if using your own/company domain) will go to the same box, but keep the distinct address. Unfortunately, depressingly many sites validate email fields, and get it wrong - thinking '+' is not allowed. IMO it's not even worth trying to get an email regex (or other vali…

Post by ethicalhack3r » Wed, Aug 31, 2016, 1:03 PM UTC

zaroth wrote: post #203

> As for Dropbox, they seem to have handled this really well. I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. In 2012 they did not disclose that hashes were stolen, so I don't see how it's really relevant. In the latest communication, they don't actually explain the risk to the user. They say it is "purely as a preventa…

Post by watson » Wed, Aug 31, 2016, 1:06 PM UTC

Post by wtbob » Wed, Aug 31, 2016, 1:12 PM UTC

cm2187 wrote: post #50

donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

2FA is a major inconvenience. The login process goes from 1-2 sec to 30sec. Sometimes a lot longer (some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time, and then you have the time it takes to find your phone, unlock, decline twice the iOS update prompt, go to the right app, find the right msg, copy the code, check it i…