Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

341–350 of 557 posts

Re: The Dropbox hack is real

#341

Post by chucksmash »

mattdotc wrote: post #318
chucksmash wrote: post #305

Earlier quoted context omitted.

If you are just starting to do this...it's very easy to forget you did it for a particular site. "I can't log in and to boot your site says there is no account matching first.last@gmail.com. What kind of Mickey Mouse operation are you running here?" "Sir, you are an idiot."

If you're using a password manager, that's a non-issue. And until we have something better than passwords, you really should be using one.

That's a solid point. I've generally avoided password managers because not knowing my (unique-per-service, strong) passwords makes me nervous in exactly the same way as not actually knowing the phone numbers of the most important N people in my life.

Re: The Dropbox hack is real

#342

Post by ktta »

rikkus wrote: post #168
ktta wrote: post #83

Earlier quoted context omitted.

I know you're being sarcastic, but with lastpass you can rotate most of your passwords. https://blog.lastpass.com/2014/12/introducing-auto-password-...

Have you tried this? It fails for most sites IME.

Yes I did (I didn't want to say it, disappointing most HNers).

I works for most of the major websites (Google, Amazon, etc. I think you can look them up). And also handles multiple google accounts pretty well, even when an google account is logged in, without logging it out. And it definitely doesn't works for the majority of the websites.

(And now for the skeptical ones) I'd say use it for websites you use 2FA since any bug (or intentional backdoor) won't be successful.

PSA: If you're using LastPass for managing passwords, DONOT use their 2FA authenticator app, since now it offers an option to autofill option. Now that is the point where you're crossing into al eggs in one basket territory.

Re: The Dropbox hack is real

#343

Post by fastball »

StanislavPetrov wrote: post #324

It never ceases to amaze me how people have bought into "cloud" computing. Its hard enough to protect your own data, on your own secure machine. Once you entrust your data to a third party you should have absolutely no doubt that it is at risk. The larger the organization that that third party is, the more inherently insecure it is. In the cloud, it only takes one careless, stupid, or inept person to expose the data…

I guess it depends on the data we are talking about?

I have a huge photo library, but I'm not a professional photographer. I'm not going to sell any of the photos I have on my computer. So when Apple told me I could offload all that data to the cloud, and worry about it less (from a backup perspective), I said "absolutely".

Sensitive data is more problematic. But the vast majority of people aren't handling "sensitive" data.

Re: The Dropbox hack is real

#344

Post by ktta »

ashitlerferad wrote: post #117
ktta wrote: post #83

Earlier quoted context omitted.

I know you're being sarcastic, but with lastpass you can rotate most of your passwords. https://blog.lastpass.com/2014/12/introducing-auto-password-...

Anyone know of an open source Firefox extension that can do this?

I don't, but would the extension in-effect need to have all your passwords too? Since I don't know of any battle tested (multiple very bad vulnerabilities exposed in public) password managers that offer this other than LastPass, I say check out the public opinion of that extension.

Re: The Dropbox hack is real

#345

Post by paulryanrogers »

mattdotc wrote: post #318
chucksmash wrote: post #305

Earlier quoted context omitted.

If you are just starting to do this...it's very easy to forget you did it for a particular site. "I can't log in and to boot your site says there is no account matching first.last@gmail.com. What kind of Mickey Mouse operation are you running here?" "Sir, you are an idiot."

If you're using a password manager, that's a non-issue. And until we have something better than passwords, you really should be using one.

A hardcopy backup is also wise

Re: The Dropbox hack is real

#346

Post by dmix »

the_mitsuhiko wrote: post #262
Uberphallus wrote: post #199

Earlier quoted context omitted.

My favourite was the unique email I used for a Russian visa application. Either the consulate was ridden with malware, or they just sold my address.

Were you actually at a consulate? Most russian visas are (pre)processed by private companies.

In that case there are probably lots of travel companies who would buy that email list.

Re: The Dropbox hack is real

#347

Post by fapjacks »

lnrdgmz wrote: post #327
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no... I've not forgotten, and this glitch has kept me from ever considering opening a Dropbox account. I'm surprised everyone else seems so forgiving of this massive screw up.

Totally. You wanna talk about people forgetting? It seems everyone has totally forgotten (or forgiven) that Dropbox was mentioned specifically in the Snowden leaks as a source.

Re: The Dropbox hack is real

#348

Post by pfg »

ocdtrekkie wrote: post #335
dimino wrote: post #309

Earlier quoted context omitted.

It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party, but are not okay reusing a password somewhere. If 1Password ever got owned, the Internet would be severely fucked. And to stem the potential flood a bit, I realize there are plenty of good counterargument built up over the years to try and combat this g…

A great example was the recent Opera browser sync hack. Everyone who uses it has to change ALL of their passwords everywhere. Password managers are a TERRIBLE idea, and it's kinda sad so many security researchers recommend them. Single point of failure is a really basic concept to understand. Password reuse has been slightly overblown as a concern. Things like your Google, GitHub, TeamViewer, bank, etc. accounts shou…

The majority of cloud-based password managers perform encryption client-side. A server hack would leave the attacker with random garbage. Short of brute-forcing your master password, they're not likely to get anything.

The only real concerns here are weak crypto and backdoors. If your threat model includes backdoors planted by software vendors you trust, not using a password manager won't help you, since someone might as well just backdoor your browser and get your brain-managed passwords as you type them. I'd stay away from webapp-based password managers, as planting a backdoor is typically easier for these.

Weak crypto is a hard problem, so you'd have to do some research and check whether the format your password manager uses has been vetted by the crypto community.

Looking at the vectors that are most commonly used to hack people today, I'm certain that password managers would be a massive improvement compared to the short and re-used passwords the majority of users use today.

Re: The Dropbox hack is real

#349

Post by fastball »

chii wrote: post #162
have_faith wrote: post #143

Earlier quoted context omitted.

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just re…

Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...

In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would).

If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.

Re: The Dropbox hack is real

#350

Post by fastball »

jrs235 wrote: post #207
have_faith wrote: post #143

Earlier quoted context omitted.

All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just re…

When one of the sites you use gets breached, you'll want/need to change your password and won't be able to use the same single algorithm. This will throw things of as you won't be able to use a single algorithm. Sure you could not use two. But you'll need to remember what sites use which one.

It's a pretty shitty algo if someone can reverse engineer it with a sample of 1...
Post reply on HN