Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evernote hacked

blog.evernote.com

Post reply on HN
Print view View original

91–100 of 220 posts

Re: Evernote hacked

#91

Post by [deleted] »

kmfrk wrote: post #23
rdl wrote: post #18

Earlier quoted context omitted.

Seriously, who doesn't do 2fa for something like this in 2013? Or 2012, or even 2011?

Apple, Microsoft, Yahoo (at least non-US), etc. ... I'm not sure if there are any bookmark services that actually support this, though it'd be a decent selling point. It was a big deal, when Google finally assed themselves to implement it for Gmail, but companies have been embarrassingly slow in following their example. Especially when they provide e-mail services. Twitter hired TFA specialists a few months back, but…

[deleted]

Re: Evernote hacked

#94

Post by Joeri »

jgrahamc wrote: post #36
UnoriginalGuy wrote: post #11

The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

It doesn't really matter what they used, as hashing speeds improve so quickly. You have to assume that the password you were using on evernote will be cracked, so to be safe you have to change it everywhere you were using it. Given that most people reuse passwords i expect a lot of follow-on exploiting of other systems with the passwords retrieved from evernote.

Re: Evernote hacked

#95

Post by dchest »

markshead wrote: post #81
bocmaxima wrote: post #78

Earlier quoted context omitted.

amen to that. I stopped using evernote awhile ago because of this and once I started using NV I never looked back. Clearly they don't take security seriously enough, which is a shame for those who don't know any better.

NV?

Notational Velocity :)

Re: Evernote hacked

#96

Post by admford »

josephscott wrote: post #48
jgrahamc wrote: post #36

Earlier quoted context omitted.

Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.( http://en.wikipedia.org/wiki/Salt_(cryptography) )) That's great. But to really reassure people they would do best to reveal the algorithm. After all, DES-based password hashes are both 'hashed and salted' but are easily broken with JtR.

Agreed, it would be nice to know they are using something reasonable, like bcrypt. Their description would satisfied by a simple MD5 + salt, which wouldn't be very good for password storage.

From the Evernote support pages:

What type of encryption does Evernote Use?

If you encrypt text within a note, we derive a 64-bit RC2 key from your passphrase and use this to encrypt the text. This is the longest symmetric key length permitted by US Export restrictions without going through a complex process to gain export approval.

We do not receive any copy of the key or your passphrase, or any escrow mechanism to recover your encrypted data. I.e., if you forget your passphrase, we can't recover your data.

User authentication (i.e. username + password) is always performed over SSL when you communicate with Evernote. This uses 1024-2048 bit RSA keys and a symmetric session key that's negotiated between your client/browser and our server.

The data in user notes is also transferred via SSL.

Several of the company's founders come from a strong encryption background (founders of CoreStreet, recently acquired by ActiveIdentity). For Evernote's consumer product, the current encryption algorithms are chosen more for exportability under the Commerce Department rather than strength, since our software permits the encryption of arbitrary user data with no escrow.

We'd be interested in offering something stronger in the future when we have the staffing to fight the lengthy export battle, but Premium users can currently use an external encryption solution to encrypt important files and then add these encrypted into Evernote.

Re: Evernote hacked

#98

Post by lysium »

I'm wondering how they perform the password reset.

Surely, you must know more than the username. But they cannot rely on the old password either, because the whole thing was set off by assuming that the old password is hacked. And they advise their user to ignore instructions per email.

So how do / could they do it?

Re: Evernote hacked

#99

Post by ams6110 »

we have found no evidence == "we really don't know"

Sorry, I'm sure the Evernote tech team is competent, but clearly some marketing spin has been put on this announcement.

Re: Evernote hacked

#100

Post by UnoriginalGuy »

quinndupont wrote: post #75
UnoriginalGuy wrote: post #10

Earlier quoted context omitted.

Encryption on /what/? Point to point or content encryption? Also if your password has been compromised and that same password is used to encrypt your data then what exactly would encryption do?

Data encryption with a private key that the user holds. Evernote, like Dropbox, etc. have your crypto keys, and thus will always be subject to hacking and such. If I, and only I, had the keys it would be up to me to keep them safe, and my data would not succumb to a hack of their database, etc.

But password resets would quite literally be impossible.
Post reply on HN