Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

271–280 of 557 posts

Re: The Dropbox hack is real

#271

Post by iyn »

raverbashing wrote: post #212
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Is there a service (email host) that can give you "infinite email aliases"? (Yes, I know about the '+' in gmail, but I suspect the word is out on it)

You can setup wildcard alias in fastmail (https://fastmail.com) and literally create addresses on the fly when signing up/sharing your email.

Re: The Dropbox hack is real

#272

Post by pfooti »

FungalRaincloud wrote: post #219
rnbrady wrote: post #210

Earlier quoted context omitted.

I've had sites reject an email containing +.

The trouble is that no one actually implements the email standard from the IETF RFC documents. In fact, some people[0] even actively discourage doing so, despite there being little in the way of good reason to not. The argument essentially goes "well, users aren't going to be likely to use those characters, unless they're doing something bad, and they make it difficult to insert the email into the database." I feel l…

Email RFC is weird. Did you know email addresses are supposed to be case sensitive? Like bob@ and Bob@ are two different addresses? Some services treat them this way, most don't. That intersection (oauth2 for example from Google can return Bob.Smith@domain.com if Bob has a GA4W account, which causes trouble when the oauth handler inconsistently lower-casifies input.

Re: The Dropbox hack is real

#273

Post by apetresc »

whateverdudes wrote: post #269
inputcoffee wrote: post #267

Earlier quoted context omitted.

How do you guys do this? IS there a service? Do you add na.melast@gmail Or do you create them on your own domain through the hosting company?

It's often called plus addressing. Quite a common feature in mail servers and mail services. MyName+ at gmail.com ends up in MyName's mailbox.

Doesn't that defeat the purpose? Surely anyone savvy enough to be dealing in black-market e-mail address lists is savvy enough to just remove everything after the + sign?

Re: The Dropbox hack is real

#274

Post by vog »

kumarski wrote: post #264
lllorddino wrote: post #248

> 1Password now has a subscription service for $3 a month and you get the first 6 months for free. Don't pay for this people. Use the open source password manager Keepass http://keepass.info/

the website is so poorly designed, it leads to consumer-non-adoptability.

Indeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine.

On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, whose URL is as complicated as: http://www.chiark.greenend.org.uk/~sgtatham/putty/download.h...

Re: The Dropbox hack is real

#275

Post by wepple »

kumarski wrote: post #264
lllorddino wrote: post #248

> 1Password now has a subscription service for $3 a month and you get the first 6 months for free. Don't pay for this people. Use the open source password manager Keepass http://keepass.info/

the website is so poorly designed, it leads to consumer-non-adoptability.

I love and use 1password, but to be honest I can't see any 'pro' features that I need/want:

https://support.1password.com/pro-features/

Re: The Dropbox hack is real

#276

Post by rexfm »

inputcoffee wrote: post #267
CookieMon wrote: post #80

Earlier quoted context omitted.

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

How do you guys do this? IS there a service? Do you add na.melast@gmail Or do you create them on your own domain through the hosting company?

I use a catch-all (*@mydomain.tld), and forward everything to the same place. Really simple and I can just make up email addresses on the fly when I need to, no config necessary, and harder to reverse than the +addresses trick.

Re: The Dropbox hack is real

#277

Post by dastbe »

apetresc wrote: post #273
whateverdudes wrote: post #269

Earlier quoted context omitted.

It's often called plus addressing. Quite a common feature in mail servers and mail services. MyName+ at gmail.com ends up in MyName's mailbox.

Doesn't that defeat the purpose? Surely anyone savvy enough to be dealing in black-market e-mail address lists is savvy enough to just remove everything after the + sign?

You never use the bare address. If it gets stripped then it gets binned.

Re: The Dropbox hack is real

#278

Post by erikb »

zaroth wrote: post #203

> As for Dropbox, they seem to have handled this really well. I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. In 2012 they did not disclose that hashes were stolen, so I don't see how it's really relevant. In the latest communication, they don't actually explain the risk to the user. They say it is "purely as a preventa…

I don't remember the details, but I remember that it was really awful how they handled it back in 2012. Really thought about dropping them (small pun intended). I am very happy to see that they got better, but am still a little sceptical.

Re: The Dropbox hack is real

#279

Post by bpicolo »

FungalRaincloud wrote: post #219
rnbrady wrote: post #210

Earlier quoted context omitted.

I've had sites reject an email containing +.

The trouble is that no one actually implements the email standard from the IETF RFC documents. In fact, some people[0] even actively discourage doing so, despite there being little in the way of good reason to not. The argument essentially goes "well, users aren't going to be likely to use those characters, unless they're doing something bad, and they make it difficult to insert the email into the database." I feel l…

I mean, there are good reasons laid out in that document. "By RFC, email addresses are unique by mixed-case. Most (99.9+%) email systems do not treat email addresses as such."

Think of the average user. Sometimes they're going to capitalize the first letter when putting in their email, and sometimes they aren't. You don't want to make it unusually difficult for them to log in.

You -should- treat email the way that vast majority of hosted services do. "Foo Bar"@gmail.com is not allowed. Covering the million edge cases seems to not be worth the trouble, especially when it might cause difficulty for the average user

Re: The Dropbox hack is real

#280

Post by trimbo »

vog wrote: post #274
kumarski wrote: post #264

Earlier quoted context omitted.

the website is so poorly designed, it leads to consumer-non-adoptability.

Indeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine. On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, w…

> their website is really ugly

I don't think it's ugly -- just dated. Isn't it weird that mentally we trust software less if they have a dated website? Shouldn't it be the opposite? (As in: a dated website means this software is mature and tested?)

Post reply on HN