That's why I don't use any fancy services for my notes, which usually contains sensitive data. I simply use Notational Velocity which encrypts my notes and stores it locally. It does provide a synchronization option with SimpleNote but they can't even be bothered with using SSL.
Evernote hacked
21–30 of 220 posts
Re: Evernote hacked
#22The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
"One-way encryption" is a peculiar choice of phrase.
[deleted]
Re: Evernote hacked
#23I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...
Seriously, who doesn't do 2fa for something like this in 2013? Or 2012, or even 2011?
Apple, Microsoft, Yahoo (at least non-US), etc. ...
I'm not sure if there are any bookmark services that actually support this, though it'd be a decent selling point.
It was a big deal, when Google finally assed themselves to implement it for Gmail, but companies have been embarrassingly slow in following their example. Especially when they provide e-mail services.
Twitter hired TFA specialists a few months back, but they are taking their sweet time about implementing the system. I've wondered for a long time why social networks aren't on top of implementing this.
It's the SSL discussion all over again.
Re: Evernote hacked
#24The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
"One-way encryption" is a peculiar choice of phrase.
It's easier to understand by lay persons than hashing.
Re: Evernote hacked
#25The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
"One-way encryption" is a peculiar choice of phrase.
It goes to efficient write-only memory.
Or the author is not qualified to do security, or thinks readers are ignorant.
Re: Evernote hacked
#26And another example of how badly Wordpress scales.
Re: Evernote hacked
#27The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
"One-way encryption" is a peculiar choice of phrase.
Meh, it's a PR person who probably had it explained 10 minutes before. They explicitly state that they are hashed and salted, so I'm not super concerned.
Re: Evernote hacked
#28I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error. Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...
I have a lot of respect for the Evernote team. They've done a great job of improving the product over the last couple of years but it's puzzling that they've recently rolled out a version of Evernote targeted at business without addressing 2fa. It's a very serious gap in their offering.
Re: Evernote hacked
#29The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
"One-way encryption" is a peculiar choice of phrase.
No, it is an accurate choice of phase. The passwords are "hashed" which is literally one-way encryption, since the encryption is lossy - the information to reverse it literally doesn't exist in the output.
The only way to "break" correctly working hashes is to encrypt tons of passwords (+salt) and see if the lossy output is identical to the output you got from the previously hashed password.
Which is a very time consuming and computably expensive process (in particular when using something newer/better than MD5/3DES).
Re: Evernote hacked
#30Earlier quoted context omitted.
Seriously, who doesn't do 2fa for something like this in 2013? Or 2012, or even 2011?
Apple, Microsoft, Yahoo (at least non-US), etc. ... I'm not sure if there are any bookmark services that actually support this, though it'd be a decent selling point. It was a big deal, when Google finally assed themselves to implement it for Gmail, but companies have been embarrassingly slow in following their example. Especially when they provide e-mail services. Twitter hired TFA specialists a few months back, but…
Google Chrome does bookmark sync using user-provided passphrase, so I'd consider that bookmark service with client side crypto and 2fa.
Crappy consumer services not supporting 2fa is somewhat understandable. No one uses Apple or Yahoo web services for business. People do seem to use Evernote in business contexts. Google Apps for your Domain is a fairly legitimate business option, as is Google Docs.