Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

251–260 of 557 posts

Re: The Dropbox hack is real

#251

Post by teach »

rtpg wrote: post #92
wrboyce wrote: post #69

Earlier quoted context omitted.

I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now. The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which…

a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely I would recommend testing theories of : - losing phone - losing computer - losing both and have reasonable backup strategies for these scenarios.

I use Google's authenticator on my phone and a 50-line python script on my desktop PC. I store the OTPs in a JSON file and the python script runs them through the TOTP algorithm and spits out my 6-digit code on the console.

I'm less worried about losing my "computer" since I don't own a laptop, plus the secrets are backed up using my normal backup process.

Re: The Dropbox hack is real

#252

Post by ryanplant-au »

raverbashing wrote: post #212
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Is there a service (email host) that can give you "infinite email aliases"? (Yes, I know about the '+' in gmail, but I suspect the word is out on it)

I use Google Apps for Work on my domain, which lets me forward all email to any address on that domain to my inbox. That way I can use adobe@ryanplant.net, github@ryanplant.net, fitbit@ryanplant.net, etc.

Re: The Dropbox hack is real

#253

Post by dboreham »

creshal wrote: post #163
scrollaway wrote: post #153

Earlier quoted context omitted.

As a service provider there is something you can do about it: Use well known out-of-band 2FA specs such as TOTP. Those are compatible with Google Authenticator and don't require a phone number, which is a massive inconvenience (not always available, not available in every country, SMS not reliable, requires an ID, not free, leaks personal information to the service provider, ...)

Well, yeah. We're not using SMS for 2FA, just for delivering monitoring alerts. With those reliability statistics (and the impossibility to improve it) I wouldn't do SMS-based 2FA at all.

We've found other interesting behavior in email-to-SMS services using it for alerts (this is in the US):

Verizon: will deliver all messages typically with low latency.

AT&T: Variable delivery latency and they have some sort of rate-limiting where if your system generates 10 alert messages within a short period, they queue them up for a couple of hours!

Inmarsat: Fast consistent delivery but they have an undocumented rate cap that when reached results in all (all!) messages being black-holed for 30 days. There is no way to reset this state. The cap is something 150 messages per month or 5 per 10 minute period.

Re: The Dropbox hack is real

#254

Post by mi100hael »

_asummers wrote: post #233
Spooky23 wrote: post #221

Earlier quoted context omitted.

Re: credit cards, unless you insist on using debit cards for some reason, who cares if they are compromised. If someone steals my credit card, AMEX has a problem. I'll take reasonable care, but I'm not going to generate transaction specific numbers or whatever unless there is a strong incentive to do so.

I wish that it was much easier to generate temporary credit card numbers for all transactions. Like upon entering real number it would generate one and swap it for you.

I believe that's pretty much what Apple Pay and the like do.

Re: The Dropbox hack is real

#255

Post by jonathanoliver »

epimenov wrote: post #95
donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

1Password can do 2FA, also syncs between all your devices. And no trusted 3rd party cloud service.

Keeping all the keys (password and 2FA tokens) in 1Password means it isn't true 2FA anymore:

https://blog.agilebits.com/2011/09/23/two-factor-or-not-two-...

Re: The Dropbox hack is real

#256

Post by willstrafach »

krupan wrote: post #243
Spooky23 wrote: post #221

Earlier quoted context omitted.

Re: credit cards, unless you insist on using debit cards for some reason, who cares if they are compromised. If someone steals my credit card, AMEX has a problem. I'll take reasonable care, but I'm not going to generate transaction specific numbers or whatever unless there is a strong incentive to do so.

and AMEX passes the cost of that problem to all AMEX customers. You are still paying for it in the end.

how so? when a card is fraudulently used to make purchases, AmEx is not refunding you from their own pockets. they take back the money from the merchant it was fraudulently spent with (a chargeback). no loss at all on their side.

Re: The Dropbox hack is real

#257

Post by mmaunder »

Dylan16807 wrote: post #126
willvarfar wrote: post #56

Earlier quoted context omitted.

I actually googled before asking my question, and couldn't come up with a good feel for just how crackable these are with hashcat... I guess I don't know the terms or the prices. Is anyone able to make any sense of the GPU hashcat benchmarks that are posted? Something distilled down to "if you spend $xxx, then you can crack any salted sha1 under 12 letters+digits+punctuation in n hours if you knew the salt; if its bc…

A rough estimate for using spot instances on EC2 says you can get maybe 40 trillion SHA1 hashes per dollar. (700MH/s and just under $.07/hour) So one dollar will crack a password 7 characters long. A million dollars will crack a password 10 characters long. Switch to bcrypt and you're now at 25 million hashes per dollar on those same instances. Now you can barely crack passwords that are 4 characters long, or for a m…

Pro tip: Build your own GPU cluster out of consumer gear. It's orders of magnitude cheaper because GPUs for the data center are expensive and/or slow. Our commercial cracker is consumer gear in a custom built chassis in colocation. Cloud GPU just isn't there yet.

Re: The Dropbox hack is real

#258

Post by qznc »

raverbashing wrote: post #212
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Is there a service (email host) that can give you "infinite email aliases"? (Yes, I know about the '+' in gmail, but I suspect the word is out on it)

The problem is, I have yet to someone who accepts '+' in email address.

Re: The Dropbox hack is real

#259

Post by jontas »

crypt1d wrote: post #145
znebby wrote: post #76

Earlier quoted context omitted.

For credit cards, check out privacy.com I recently started using it, works great.

This looks pretty cool, but seems like they are invite-only for now... Any chance you can drop an invite for a fellow HNer? :)

I've got an invite, contact me via the email in my HN profile and I'll send it over.

Re: The Dropbox hack is real

#260

Post by feklar »

_asummers wrote: post #233
Spooky23 wrote: post #221

Earlier quoted context omitted.

Re: credit cards, unless you insist on using debit cards for some reason, who cares if they are compromised. If someone steals my credit card, AMEX has a problem. I'll take reasonable care, but I'm not going to generate transaction specific numbers or whatever unless there is a strong incentive to do so.

I wish that it was much easier to generate temporary credit card numbers for all transactions. Like upon entering real number it would generate one and swap it for you.

Many had this feature (and Paypal for a while) but dropped it for some reason. My guess is they want to encourage subscription/repeat billing or some kind of fraud was rampant generating temporary numbers.
Post reply on HN