Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

381–390 of 557 posts

Re: The Dropbox hack is real

#381

Post by rspeer »

krupan wrote: post #362
rspeer wrote: post #321

Earlier quoted context omitted.

...except not traceable, works with people's payment systems, sends actual US dollars, and doesn't have a 5% chance of getting stolen.

That's an amazing system you just invented, I wish it existed :-)

Fine, "not traceable by arbitrary people on the Internet".

I know the credit card company and everyone they share your data with can see your transactions, and that's a problem some may wish to avoid, but that is still a much smaller number of people who can see your transactions than Bitcoin. Bitcoin does not inherently include privacy.

Re: The Dropbox hack is real

#382

Post by wyldfire »

thwarted wrote: post #376
oxplot wrote: post #109

Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.

I'm not sure how much I can trust the results of a site that claims an email address I only use for one site has been breached on sites and services I've never been to. However it's calculating if what you enter into the form appears in the leaked content sure gives a lot of false positives. Which I suppose forces more awareness, but it doesn't instill a lot of confidence.

I think false positives like this are worth reporting upstream.

FWIW I was subscribed and didn't get anything until this most recent breach. Unfortunately GMail thought it was spam (speaking of false positives!).

Re: The Dropbox hack is real

#383

Post by fapjacks »

amiraliakbari wrote: post #373
ljk wrote: post #352

Earlier quoted context omitted.

are there better alternatives though?

if you are willing to use a rather more complicated system with harder setup, syncthing.net is great, it syncs files between your computers without needing a cloud service. For more similar alternatives, running owncloud on a VM is straightforward. And, of course the featureset is limited compared to Dropbox.

I had big problems with OwnCloud. Specifically it ate files at work, but did so in such an insidious manner (slowly, over time, with no indication that anything was wrong) that I don't trust it to this day. I haven't checked lately, but the issue was acknowledged by OwnCloud devs, with the workaround being to "use a secondary sync application" (no kidding). These days I use Seafile, and I can also say that your suggestion of Syncthing is a good one. I have used and enjoy both Syncthing and Seafile. Just a word of advice: Don't trust Seafile to encrypt your data. Use Veracrypt (or equivalent) in place of the built-in "encryption" offered by Seafile.

Re: The Dropbox hack is real

#384

Post by iyn »

tocklime wrote: post #287
iyn wrote: post #271

Earlier quoted context omitted.

You can setup wildcard alias in fastmail ( https://fastmail.com ) and literally create addresses on the fly when signing up/sharing your email.

Fastmail has a really nice subdomains feature - I have an alias in fastmail of 'shop@mydomain.com'. Any email for XXX@shop.mydomain.com gets delivered to shop+XXX@mydomain.com. Better than catchall, because all the spam gets sent to JohnSmith@mydomain.com, which is dropped.

Wow, this is great feature, thanks for the tip! :)

Re: The Dropbox hack is real

#385

Post by fapjacks »

Rumudiez wrote: post #355
ljk wrote: post #352

Earlier quoted context omitted.

are there better alternatives though?

"Better" is subjective. I consider Google Drive much better, personally. Alternatives, though? Plenty: Google Drive, Box, OneDrive, iCloud Backup and iCloud Drive.. the list goes on with a simple Google search for "online storage"

Don't forget Spideroak! They offer end-to-end encryption of your data.

Re: The Dropbox hack is real

#387

Post by nommm-nommm »

dimino wrote: post #374
chrisfosterelli wrote: post #333

Earlier quoted context omitted.

You don't give your passwords to LastPass either, you give them encrypted random noise they can't do anything with.

And who, exactly, encrypts them for you? Dropbox was also encrypting your passwords, FWIW.

IIRC encryption and decryption is done on the client side and the server only stores encrypted data.

Dropbox was not encrypting passwords they were hashing them.

If you stored already encrypted files on Dropbox nobody can decrypt those files provided your encryption key is good.

Re: The Dropbox hack is real

#388

Post by nommm-nommm »

this_user wrote: post #351
tzakrajs wrote: post #323

Earlier quoted context omitted.

Using a strong key and cipher, you should feel safe giving anyone your information.

Keys can still be cracked, and ciphers can be broken. Not giving anyone your information, if you don't have to, is always the preferred option.

No it's not, like with anything it's a trade off.

Re: The Dropbox hack is real

#389

Post by turshija »

odbol_ wrote: post #338
lnrdgmz wrote: post #327

Earlier quoted context omitted.

> On a side note, don't forget the time dropbox accepted ANY password during logins - http://www.cnet.com/news/dropbox-confirms-security-glitch-no... I've not forgotten, and this glitch has kept me from ever considering opening a Dropbox account. I'm surprised everyone else seems so forgiving of this massive screw up.

Haha for me it's the opposite. My password never works in Dropbox. I think it's because they don't support spaces in passwords, but they don't tell you when you change your password. They just accept the change and then you can't login.

I'm using password with spaces for Dropbox without any problems. Must be something else is an issue at your side... Have you tried resetting it ?

Re: The Dropbox hack is real

#390

Post by rb12345 »

ocdtrekkie wrote: post #336
vog wrote: post #274

Earlier quoted context omitted.

Indeed. I would really love to recommend Keepass, but their website is really ugly and makes the impression of a non-polished software - even though Keepass is absolute mature and fine. On the other hand, the PuTTY website is also everything but polished, but people have always been using it. Also, I suspect that most people will get it through the third-party site "www.putty.org" instead of the real PuTTY website, w…

You know what always gets me: PuTTY's website isn't served over HTTPS. That software everyone downloads to type all their firewall and router credentials into... is from a website not served over HTTPS. I see the download and signature links are, but if I could have this non-HTTPS website offer up different links to your web browser...

The downloads are all GPG-signed, so that shouldn't be an issue. You have the issue of the initial trust, but that applies to HTTPS too to a lesser extent.
Post reply on HN