Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox wasn't hacked

blog.dropbox.com

Post reply on HN
Print view View original

11–20 of 38 posts

Re: Dropbox wasn't hacked

#11

Post by Blackthorn »

jen729w wrote: post #6

So ... what's the lesson here for our non-nerdy friends & family? I immediately sent my closest friends a "change your Dropbox password" email, which is still valid because, whether they were hacked or not, someone may now have their password. Which is probably also their password to Facebook. I suppose the question is, does it matter if Dropbox was hacked or if these credentials were gained by some other means? The…

Try to get them on password managers. I've gotten my extremely non-technical wife to use Lastpass and she does it with ease. It really is the best thing they can do for their own security.

Re: Dropbox wasn't hacked

#12

Post by ubernostrum »

korzun wrote: post #5

Would be interesting to know what third party service it was and how they were able to make that link. Also the pastebin claimed such a large amount (6,937,081) of impacted users but only showed a really small sample that started with the letter 'b'. Based on that sample they were already covering letters (bf, bg, bh). So I doubt this is anywhere near the claimed amount. Asking for 'BTC' to leak more (who wants to pa…

Would be interesting to know what third party service it was and how they were able to make that link.

Dropbox uses email address + password for authentication.

If you have a list of email addresses and passwords from accounts on some other compromised service, why not try them against Dropbox to see if any of those people have Dropbox accounts with the same password?

Re: Dropbox wasn't hacked

#13

Post by tzs »

kolev wrote: post #8
korzun wrote: post #5

Would be interesting to know what third party service it was and how they were able to make that link. Also the pastebin claimed such a large amount (6,937,081) of impacted users but only showed a really small sample that started with the letter 'b'. Based on that sample they were already covering letters (bf, bg, bh). So I doubt this is anywhere near the claimed amount. Asking for 'BTC' to leak more (who wants to pa…

Why do you trust the hacker? By definition, hackers are not the trustworthy kind. He may have 7 million emails and passwords from elsewhere and make bold claims to collect bitcoins from lower ranks of hackers. I initially thought that some smartass created a bunch of accounts and posted them to collect some bitcoins from the naive. Particularly, because emails are so similar, i.e. I speculated that he did that to sim…

> By definition, hackers are not the trustworthy kind.

That's a pretty bold assertion to make on a a site called "Hacker News"...

Re: Dropbox wasn't hacked

#14

Post by hug »

mkal_tsr wrote: post #7

Once again, the "journalists" can't be arsed to do any actual work but instead parrot what they heard. Absolutely shameful on their part. Edit: For those down-voting me, please explain how condemning factually incorrect "news" is bad? Thanks :-)

Which journalists? Ars Technica posted an article with the qualifying word "apparently" in the title, weasel words like "appears" in the body, contacted Dropbox for comment, had obviously tested the password reset functionality since they mention it was sluggish.

Their suggestion was "reset your password anyway, and turn on 2fa". None of this seems unreasonable.

Re: Dropbox wasn't hacked

#15

Post by hug »

Interestingly enough, on the same pastebin site that the leak first appeared, we now have someone programmatically changing the account passwords in the leak: http://pastebin.com/LsKrspK5

There's another set of account credentials here: http://pastebin.com/jHEjBLrQ which are all starting with the letter A. It covers AA to AZ, and spans 900 accounts. Does this mean there's only ~24,000 accounts compromised?

Strangely enough, that was the 'sixth' teaser. I found the fifth -- http://pastebin.com/CsN3SrGA -- but all of the passwords in that list are "latenightbootycalls". I cannot find the 'fourth' just yet.

(Someone let me know if the link to the paste is frowned upon. It's pretty easy to find on Google, however, so I figure I'm doing no additional damage.)

Re: Dropbox wasn't hacked

#16

Post by mkal_tsr »

hug wrote: post #14
mkal_tsr wrote: post #7

Once again, the "journalists" can't be arsed to do any actual work but instead parrot what they heard. Absolutely shameful on their part. Edit: For those down-voting me, please explain how condemning factually incorrect "news" is bad? Thanks :-)

Which journalists? Ars Technica posted an article with the qualifying word "apparently" in the title, weasel words like "appears" in the body, contacted Dropbox for comment, had obviously tested the password reset functionality since they mention it was sluggish. Their suggestion was "reset your password anyway, and turn on 2fa". None of this seems unreasonable.

Any site that published anything related to Dropbox and being hacked prior to receiving a response from Dropbox for clarification is guilty IMO. Everyone is in a rush these days to be the first with the most click-baity headline, accuracy be damned. They have zero fucks to give about the repercussions of what they publish and it is downright shameful. The more people allow weasel words to be acceptable in news, the more they're willing to accept narratives and not objectivity. I genuinely despise Dropbox, but that doesn't mean they deserve falsehoods blasted about them. We live in the disinformation era and it has and will destroy many arguments, careers, companies, and lives. Shameful.

Re: Dropbox wasn't hacked

#17

Post by ozh »

jen729w wrote: post #6

So ... what's the lesson here for our non-nerdy friends & family? I immediately sent my closest friends a "change your Dropbox password" email, which is still valid because, whether they were hacked or not, someone may now have their password. Which is probably also their password to Facebook. I suppose the question is, does it matter if Dropbox was hacked or if these credentials were gained by some other means? The…

Issue explained to non-nerdy friends: http://xkcd.com/792/

Re: Dropbox wasn't hacked

#20

Post by mhandley »

hug wrote: post #15

Interestingly enough, on the same pastebin site that the leak first appeared, we now have someone programmatically changing the account passwords in the leak: http://pastebin.com/LsKrspK5 There's another set of account credentials here: http://pastebin.com/jHEjBLrQ which are all starting with the letter A. It covers AA to AZ, and spans 900 accounts. Does this mean there's only ~24,000 accounts compromised? Strangely…

Like the other set of credentials, there's a relative scarcity of gmail addresses. I'd expect dropbox accounts to be a pretty good sampling of email addresses. Either these have had gmail addresses removed (unlikely as a few are in there), or the list comes from somewhere where hotmail and yahoo are more popular that gmail - wonder where that would be?
Post reply on HN