Dropbox: Security update & new features
blog.dropbox.com
Dropbox: Security update & new features
1–10 of 69 posts
Re: Dropbox: Security update & new features
#2I love the art at the top. Go Jon!
Re: Dropbox: Security update & new features
#3Good, solid response to the intrusion. I'm particularly happy about the two-factor opportunity. I have no problem re-authenticating every 60-90 days with an SMS sent to my phone, and _definitely_ want any new system to be two-factored before having access to my Dropbox.
Re: Dropbox: Security update & new features
#4> In some cases, we may require you to change your password. (For example, if it’s commonly used or hasn’t been changed in a long time)
This is ambiguous...by "commonly used" do they mean 1) I'm logging in with my password frequently or 2) my password itself is a commonly used password? I'm assuming (and praying!) they mean the former since the latter would mean they're storing my password in plaintext.
UPDATE: Dropbox doesn't store in plaintext. I was incorrect to assume these were the only two possibilities. Confer child comments.
Re: Dropbox: Security update & new features
#5> In some cases, we may require you to change your password. (For example, if it’s commonly used or hasn’t been changed in a long time) This is ambiguous...by "commonly used" do they mean 1) I'm logging in with my password frequently or 2) my password itself is a commonly used password? I'm assuming (and praying!) they mean the former since the latter would mean they're storing my password in plaintext. UPDATE: Dropb…
They wouldn't have to store your password in plaintext to determine that. They could just hash commonly used passwords and compare the hashes to yours.
Re: Dropbox: Security update & new features
#6> In some cases, we may require you to change your password. (For example, if it’s commonly used or hasn’t been changed in a long time) This is ambiguous...by "commonly used" do they mean 1) I'm logging in with my password frequently or 2) my password itself is a commonly used password? I'm assuming (and praying!) they mean the former since the latter would mean they're storing my password in plaintext. UPDATE: Dropb…
They wouldn't have to store your password in plaintext to determine that. They could just hash commonly used passwords and compare the hashes to yours.
If the number of salts used in the system is equal to the number of users, this could be expensive.
Re: Dropbox: Security update & new features
#7> In some cases, we may require you to change your password. (For example, if it’s commonly used or hasn’t been changed in a long time) This is ambiguous...by "commonly used" do they mean 1) I'm logging in with my password frequently or 2) my password itself is a commonly used password? I'm assuming (and praying!) they mean the former since the latter would mean they're storing my password in plaintext. UPDATE: Dropb…
It wouldn't, necessarily -- I thought about this a little, and there are ways to identify commonly used passwords without storing them in plain text.
They could check passwords on login (before salting/hashing) against a blacklist of 'commonly used passwords'. This is probably the most secure method, as it only implies that users passwords are not on the blacklist, but does not imply plain text storage or unsalted hashes.
If they were not salting their hashes, then they could query their database for hashes that match the hashed version of commonly used passwords. Similar to the blacklist above, but implies that the passwords are stored unsalted, which is sad.
Re: Dropbox: Security update & new features
#8Earlier quoted context omitted.
They wouldn't have to store your password in plaintext to determine that. They could just hash commonly used passwords and compare the hashes to yours.
If the number of salts used in the system is equal to the number of users, this could be expensive.
They will just check your password against a list of 'bad' passwords when you log in. No need to brute force the stored hash.
Re: Dropbox: Security update & new features
#9I'm curious who all received this email? Was it sent to the entire user base? If not, what selection criteria did they use?
Everyone I've talked to seems to have received the "reset your password" email. I'm quite curious because I'm certain (up until now) that the password I used for Dropbox was both (a) not commonly used and (b) had been changed recently and (c) not leaked anywhere else (to the best of my knowledge).
Re: Dropbox: Security update & new features
#10> In some cases, we may require you to change your password. (For example, if it’s commonly used or hasn’t been changed in a long time) This is ambiguous...by "commonly used" do they mean 1) I'm logging in with my password frequently or 2) my password itself is a commonly used password? I'm assuming (and praying!) they mean the former since the latter would mean they're storing my password in plaintext. UPDATE: Dropb…
Dropboxer here. We do not store passwords in plaintext, or unsalted. End sentence. :)