Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

311–320 of 557 posts

Re: The Dropbox hack is real

#311

Post by gengkev »

rtpg wrote: post #92
wrboyce wrote: post #69

Earlier quoted context omitted.

I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now. The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which…

a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely I would recommend testing theories of : - losing phone - losing computer - losing both and have reasonable backup strategies for these scenarios.

Isn't that the point of having backup codes for Google, etc.? I can use those to restore my account, and secure them however I like.

Backing up the secrets to a third party makes them vulnerable to anyone who can hack your Authy account. I'm not sure what that requires, possibly hacking a phone number. Of course, there's also a backup password, but then you're just replacing the "physical" factor in 2FA with another password.

Without Authy, to compromise my account, you need physical access to my phone, my backup codes, or another backup mechanism I've specified. Authy just provides an additional way to compromise my account, and I don't think it provides any real benefit in exchange for that risk.

Re: The Dropbox hack is real

#312

Post by macintux »

raverbashing wrote: post #212
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Is there a service (email host) that can give you "infinite email aliases"? (Yes, I know about the '+' in gmail, but I suspect the word is out on it)

https://www.33mail.com

Re: The Dropbox hack is real

#313

Post by funkymike »

trimbo wrote: post #280
vog wrote: post #274

Earlier quoted context omitted.

Indeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine. On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, w…

> their website is really ugly I don't think it's ugly -- just dated. Isn't it weird that mentally we trust software less if they have a dated website? Shouldn't it be the opposite? (As in: a dated website means this software is mature and tested?)

The problem with dated websites is that they have the appearance of being thrown on the web in 10 minutes and forgotten about rather than being mature and tested.

If the software is well supported and maintained than the website should be too.

Re: The Dropbox hack is real

#314

Post by [deleted] »

dvcrn wrote: post #137
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastm…

[deleted]

Re: The Dropbox hack is real

#315

Post by macintux »

dimino wrote: post #309
jonknee wrote: post #288

Earlier quoted context omitted.

1Password is well worth the money. It is well designed for both desktop and mobile and I am happy to pay for software that I use every day.

It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party, but are not okay reusing a password somewhere. If 1Password ever got owned, the Internet would be severely fucked. And to stem the potential flood a bit, I realize there are plenty of good counterargument built up over the years to try and combat this g…

> It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party

That sounds more like LastPass than 1Password, although I haven't looked at the new subscription offering.

I don't give my passwords to 1Password.

Re: The Dropbox hack is real

#317

Post by CriminallyInane »

trimbo wrote: post #280
vog wrote: post #274

Earlier quoted context omitted.

Indeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine. On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, w…

> their website is really ugly I don't think it's ugly -- just dated. Isn't it weird that mentally we trust software less if they have a dated website? Shouldn't it be the opposite? (As in: a dated website means this software is mature and tested?)

Isn't the mentality more to do with insecure sites having dated websites with misleading links etc. Unless its a known company a dated/poor website often flags warnings for me about security, support for the product and more.

Re: The Dropbox hack is real

#318

Post by mattdotc »

chucksmash wrote: post #305
rrdharan wrote: post #270

Earlier quoted context omitted.

You can use anything after a + character with Gmail. E.g. myaddress+service1@gmail.com will go to your inbox and you can filter on it.

If you are just starting to do this...it's very easy to forget you did it for a particular site. "I can't log in and to boot your site says there is no account matching first.last@gmail.com. What kind of Mickey Mouse operation are you running here?" "Sir, you are an idiot."

If you're using a password manager, that's a non-issue. And until we have something better than passwords, you really should be using one.

Re: The Dropbox hack is real

#319

Post by lobster_johnson »

inputcoffee wrote: post #267
CookieMon wrote: post #80

Earlier quoted context omitted.

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

How do you guys do this? IS there a service? Do you add na.melast@gmail Or do you create them on your own domain through the hosting company?

I use Fastmail, which provides very nice wildcard aliasing under a domain. *@mydomain goes to a single inbox. I can also create specific aliases such as foo@mydomain.

Re: The Dropbox hack is real

#320

Post by jonknee »

dimino wrote: post #309
jonknee wrote: post #288

Earlier quoted context omitted.

1Password is well worth the money. It is well designed for both desktop and mobile and I am happy to pay for software that I use every day.

It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party, but are not okay reusing a password somewhere. If 1Password ever got owned, the Internet would be severely fucked. And to stem the potential flood a bit, I realize there are plenty of good counterargument built up over the years to try and combat this g…

My passwords are synced through WiFi on my local network, but thanks for your concern.
Post reply on HN