Dropbox was breached also around 2012.
I remember that day. It was the day I stopped using dropbox.
A recent security incident involving Dropbox Sign
11–20 of 76 posts
Re: A recent security incident involving Dropbox Sign
#12"Upon further investigation, we discovered that a threat actor had accessed data including Dropbox Sign customer information such as emails, usernames, phone numbers and hashed passwords, in addition to general account settings and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication." hashed passwords, API keys, OAuth tokens, MFA... Oh no.
Hashed passwords? Surely they mean hashed and salted passwords. Right? Right???
Re: A recent security incident involving Dropbox Sign
#13At least it's a hack this time, it's not like when they forgot to enable authentication and you could sign-in to any Dropbox just by entering the e-mail. https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
It seems most billion dollar companies, are just Dave, hacking away on Node and dropping directly to production... :-)
Re: A recent security incident involving Dropbox Sign
#14At least it's a hack this time, it's not like when they forgot to enable authentication and you could sign-in to any Dropbox just by entering the e-mail. https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
It seems most billion dollar companies, are just Dave, hacking away on Node and dropping directly to production... :-)
[deleted]
Re: A recent security incident involving Dropbox Sign
#15Earlier quoted context omitted.
I use Proton Drive [1], they offer e2ee but I agree with you: the Dropbox app experience is probably still the best. [1] https://proton.me/drive
OK, so there is no fundamental obstacle for providing true e2ee.
Of course there isn't, but it limits efficiency and features.
For example, you will miss all the fancy features Google Images does in cloud and user experience might be slower, since everything must be processed and downloaded on client side. Some level of metadata is always unencrypted.
Re: A recent security incident involving Dropbox Sign
#16Earlier quoted context omitted.
I use Proton Drive [1], they offer e2ee but I agree with you: the Dropbox app experience is probably still the best. [1] https://proton.me/drive
OK, so there is no fundamental obstacle for providing true e2ee.
Of course not. It’s just storing bits at the end of the day. But storing seemingly random bits will always be more expensive than storing predictable bits, and this case is no exception: Proton is roughly 4x more expensive per bit than Dropbox.
Re: A recent security incident involving Dropbox Sign
#17> Based on our investigation, a third party gained access to a Dropbox Sign automated system configuration tool. The actor compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this acc…
I really recommend listening to the Darknet Diaries podcast (available on Spotify at least). Really high-quality interviews with both ex and current hackers, cybersecurity professionals etc.
Re: A recent security incident involving Dropbox Sign
#18"Upon further investigation, we discovered that a threat actor had accessed data including Dropbox Sign customer information such as emails, usernames, phone numbers and hashed passwords, in addition to general account settings and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication." hashed passwords, API keys, OAuth tokens, MFA... Oh no.
Hashed passwords? Surely they mean hashed and salted passwords. Right? Right???
They were using SHA1, then they migrated.
68 million accounts dumped: https://www.theguardian.com/technology/2016/aug/31/dropbox-h...
https://www.troyhunt.com/the-dropbox-hack-is-real/
now they first hash the password using SHA512 (with a per-account salt)
then they hash the password with bcrypt (with the default strength)
then they encrypt the password with a key that the application server runs with, but that is not stored in the database.
So yes, hashed and salted.
Re: A recent security incident involving Dropbox Sign
#19Dropbox was breached also around 2012.
That was when i stopped using the cloud for storing personal stuff.
Fast forward a decade and i've more than had my fill of self hosting stuff, so a couple of years ago i went all in on the cloud again, though with a bit of a different approach.
Stuff that is not really sensitive is uploaded "as is". Yes, that includes our photos. While i don't want our photo library to be "public domain", there is nothing there of particular interest to anybody but my family and I.
For sensitive stuff i use Cryptomator to end to end encrypt data before uploading them to the cloud. It has desktop and mobile clients that allows me transparent access to my encrypted files on the go.
Re: A recent security incident involving Dropbox Sign
#20Earlier quoted context omitted.
I use Proton Drive [1], they offer e2ee but I agree with you: the Dropbox app experience is probably still the best. [1] https://proton.me/drive
OK, so there is no fundamental obstacle for providing true e2ee.
What I'd really like is for the encryption to be plugable and orthogonal to file syncing.
Ie: authentication with dropbox/proton/bittorrent concerns only that you pay your storage/ingest/egress bill, but is otherwise unprotected and in the clear. Encryption of the file payload and metadata as a "bring-your-own" — on device — stream cypher (and key derivation, key management). Key exchange and sharing among devices or users might then use yet another service or mechanism.
Pretty sure presenting all that in a slick easy to understand way has significant challenges, but it would be great to alleviate some of the dropbox as a single point of failure.