Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

111–120 of 557 posts

Re: The Dropbox hack is real

#111

Post by djsumdog »

VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

I really dislike password managers and there's good news: you don't need one to have unique password per site. A good password algorithm is very useful:

http://penguindreams.org/blog/my-accounts-been-hacked-no-it-...

The article is dated. I'd suggest a longer minimum and 2 factor for services that support it. The advantage is unique passwords that you don't have to look up.

Re: The Dropbox hack is real

#112

Post by atmosx »

VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

I use 1Password and I'm fairly happy with it. I also use dropbox for sync, since other methods suck. I didn't had a Dropbox account in 2012 so I'm not sure if I'm affected, but anyway, my 1Password chain should be secure even if stolen/accessed... That's what encryption is all about anyway.

Re: The Dropbox hack is real

#113

Post by loup-vaillant »

thomasahle wrote: post #24
aluhut wrote: post #12

Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it…

> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?

For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength.

Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).

Re: The Dropbox hack is real

#114

Post by viraptor »

willvarfar wrote: post #11

50% of the leaked hashes were bcrypt and the other 50% were salted sha1. So, asking the HNers who crack passwords or follow the tech closely and have a good feel: Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt? And how can this be projected to change in the next couple of years?

It depends how many rounds of sha1 were used and what was the load setting on bcrypt. You can make either one harder to break by playing with those parameters.

Re: The Dropbox hack is real

#115

Post by pingec »

0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

Would be cool to have a service do this automatically and test which services leak email addresses and which don't.

Re: The Dropbox hack is real

#116

Post by aluhut »

microtonal wrote: post #53
thomasahle wrote: post #24

Earlier quoted context omitted.

> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?

It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, prov…

Both.

Re: The Dropbox hack is real

#117

Post by ashitlerferad »

ktta wrote: post #83
akerro wrote: post #23

Earlier quoted context omitted.

Wow, single point of failure for all my accounts, all my credential, all my personal, private and public data. I would love to use it!

I know you're being sarcastic, but with lastpass you can rotate most of your passwords. https://blog.lastpass.com/2014/12/introducing-auto-password-...

Anyone know of an open source Firefox extension that can do this?

Re: The Dropbox hack is real

#119

Post by aluhut »

cel1ne wrote: post #79
tonyedgecombe wrote: post #71

Earlier quoted context omitted.

Why?

They are a company focussing on just one commercial product. Also I find there's some kind of pride in quality amongst mac-developers. Plus the lastpass vulnerability that was disclosed a couple of month ago seemed pretty basic and I haven't heard from serious vulnerabilities in 1password for a while. And that 1Password is local. All of that is just a feeling though, of course.

> They are a company focussing on just one commercial product.

Or: "they are a company depending on just one commercial product".

Doesn't look that good anymore hm?

Try keepass for excample. It's local too and it's open source.

Re: The Dropbox hack is real

#120

Post by 0x0 »

prof_hobart wrote: post #90
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

I do the same, but some companies don't seem to be interested. I've had two different emails linked to a magazine's website and had spam to both. When I've contacted them about it, they've been absolutely adamant that the spammer must have (twice) guessed the exact email address that I've had there.

I've had the same response. When I ask how come the spammer managed to successfully guess exactly the particular unique email address (including unique hashes appended to the service name as part of the username side of the address) on the first and only attempt (verified by looking at mail server logs), they just shrug.
Post reply on HN