111–120 of 220 posts
Instead, you have to tap the "authentication failed" notification. Then you can change the password.
For anyone who is as puzzled as I was about how to change the password in the Android app, the answer is you can't change it in the app. (!) Instead, you have to tap the "authentication failed" notification. Then you can change the password.
The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
I haven't received such an email, wonder why. Anyway Evernotes android client wasn't very good and it was far too slow to start. And now the have been hacked. Anybody know a good alternative?
Earlier quoted context omitted.
No, it's usually known by the format, or even stored together with the password Example: crypt stored the password in the format: $id$salt$encrypted
But this is why we do one or both things: strip obvious things from hashed password and store them separately or add a trivial character reshuffling algorithm. The point is that hacker would not only have to steal your hashed passwords, but also steal and understand your code. Makes it more complicated.
The security of your system can never depend on an attacker not knowing the implementation.
Or: Security through obscurity (is no security)
Using gimmicks like for example shuffling some characters in the hash may delay some attacks. But the problem is that these techniques are usually done on systems that have no sufficient security.
Have a big salt and use PBKDF2 or Bcrypt and you know the exact difficulty of getting the passwords.
The following blog post is also being sent to all Evernote users as an email communication. Evernote’s Operations & Security team has discovered and blocked suspicious activity on the Evernote network that appears to have been a coordinated attempt to access secure areas of the Evernote Service. As a precaution to protect your data, we have decided to implement a password reset. Please read below for details and inst…
I haven't received such an email, wonder why. Anyway Evernotes android client wasn't very good and it was far too slow to start. And now the have been hacked. Anybody know a good alternative?
Earlier quoted context omitted.
The "tradeoff" seems to be "make the server into a dumb store for encrypted data." At which point, you don't have Evernote (an API for fuzzy-matching clippings punted into it from various devices), you have Evernote (a set of fat client programs) plus a POSS (Plain Old Storage Service, like S3.) In fact, the workflow sounds like it would have more in common with editing a Word document over SMB than with making web r…
I don't think you got quite what I'm trying to say--the whole point of Evernote is that all your data is "there", and the collated index for finding this or that is "there", and so any individual piece of data doesn't need to be on this device or that device. When you insert a new piece of data, all you need is that piece of data. You send it off to Evernote, and they stick it into your database. Then, later--still w…
Thinking off the top of my head:
priv_key = AES_DECRYPT(PBKDF2(pincode,salt),iv,RSA_key_from_keychain)
aes_key = rsa_decrypt(priv_key,encrypted_aes_key)
Earlier quoted context omitted.
But this is why we do one or both things: strip obvious things from hashed password and store them separately or add a trivial character reshuffling algorithm. The point is that hacker would not only have to steal your hashed passwords, but also steal and understand your code. Makes it more complicated.
No The security of your system can never depend on an attacker not knowing the implementation. Or: Security through obscurity (is no security) Using gimmicks like for example shuffling some characters in the hash may delay some attacks. But the problem is that these techniques are usually done on systems that have no sufficient security. Have a big salt and use PBKDF2 or Bcrypt and you know the exact difficulty of ge…
Earlier quoted context omitted.
Agreed, it would be nice to know they are using something reasonable, like bcrypt. Their description would satisfied by a simple MD5 + salt, which wouldn't be very good for password storage.
From the Evernote support pages: What type of encryption does Evernote Use? If you encrypt text within a note, we derive a 64-bit RC2 key from your passphrase and use this to encrypt the text. This is the longest symmetric key length permitted by US Export restrictions without going through a complex process to gain export approval. We do not receive any copy of the key or your passphrase, or any escrow mechanism to…
Earlier quoted context omitted.
It doesn't really matter what they used, as hashing speeds improve so quickly. You have to assume that the password you were using on evernote will be cracked, so to be safe you have to change it everywhere you were using it. Given that most people reuse passwords i expect a lot of follow-on exploiting of other systems with the passwords retrieved from evernote.
IANASE (I am not a security expert): Would the following service work: Assume a central account/profile service. This service would allow you to have a single login to this service, with a directory of pretty much any/all sites and services online. The external services would receive a hashed token of your account/authorization. They would check for the validity of the token each [interval|day|time-the-service-was-ac…