Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

121–130 of 557 posts

Re: The Dropbox hack is real

#121

Post by chrisseaton »

cm2187 wrote: post #77
markdown wrote: post #63

Earlier quoted context omitted.

> Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how chip-and-pin works?

Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.

> the merchant still gets to see my credit card numbers (both sides)

With chip and pin? I don't think they do.

Re: The Dropbox hack is real

#122

Post by aluhut »

guitarbill wrote: post #82
tonyedgecombe wrote: post #71

Earlier quoted context omitted.

Why?

For me, it's that 1Password runs locally and doesn't need to phone home, whereas LastPass is "cloud". Also, LastPass being owned by LogMeIn doesn't sit right with me, but that's definitely personal. No idea about Keepass(x), although I found that ecosystem to be confusing, with different apps for different platforms you might accidentally download a rouge one on e.g. your phone. I know, paranoia.

My mother is able to run keepass and she still has a problem with double clicking.

But sure. Looking for yourself is not easy. You have to do something for yourself and not just throw money on some company that is depending on this one product.

Not sure if your paranoia is directed the right way here though.

Re: The Dropbox hack is real

#123

Post by aluhut »

loup-vaillant wrote: post #113
thomasahle wrote: post #24

Earlier quoted context omitted.

> Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?

For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength. Or better yet, ask actual security experts about that setup, they're likely t…

Exactly my thoughts and I'm not alone here. There is a growing attitude against cloud infrastructure which together with the industries hype for it will lead to a interesting clash at some point.

I hope this will bring out even more cloudless solutions in the future.

Re: The Dropbox hack is real

#124

Post by neltnerb »

m0nty wrote: post #108
VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

Download a password manager like Keepass, Lastpass or Password Safe: https://en.wikipedia.org/wiki/List_of_password_managers I use Keepass, it does exactly what I need. Secure the password manager itself with a long password. Put your logins into it, and generate a unique random password for each one, then go to the website in question and change the password to the new one. When you want to login to that website, op…

Yeah, I've been doing that same thing with security questions, except I just generate a new random password for each. I really wish that field was automatically blocked from view without the master password like the passwords themselves are when you toggle that (excellent) option.

Re: The Dropbox hack is real

#125

Post by Klathmon »

tonicoto wrote: post #68
cm2187 wrote: post #22

Earlier quoted context omitted.

Mostly what Troy says is that the sha1 were salted with a salt not available in the files he was provided. That doesn't mean the salt wasn't leaked. But if it wasn't, and the salt was a 128bit, unique to each password, cryptographic random salt, I'd say they are not really vulnerable. So it depends on the strength, randomness and availability of the salt.

How come the salts aren't available? Did the attacker choose not to release them, or were they stored elsewhere?

Or were they really bad salts? Like a hash of the username?

Re: The Dropbox hack is real

#126

Post by Dylan16807 »

willvarfar wrote: post #56
mmaunder wrote: post #28

Earlier quoted context omitted.

The salts for the sha1 passwords weren't leaked. So they're hard to crack in practical terms. Depends how random they were. See hashcat docs and benchmarks for complete answers to your questions. The GPU versions of hashcat.

I actually googled before asking my question, and couldn't come up with a good feel for just how crackable these are with hashcat... I guess I don't know the terms or the prices. Is anyone able to make any sense of the GPU hashcat benchmarks that are posted? Something distilled down to "if you spend $xxx, then you can crack any salted sha1 under 12 letters+digits+punctuation in n hours if you knew the salt; if its bc…

A rough estimate for using spot instances on EC2 says you can get maybe 40 trillion SHA1 hashes per dollar. (700MH/s and just under $.07/hour) So one dollar will crack a password 7 characters long. A million dollars will crack a password 10 characters long.

Switch to bcrypt and you're now at 25 million hashes per dollar on those same instances. Now you can barely crack passwords that are 4 characters long, or for a million dollars you get 7 characters.

That's if you know the salt, of course. Otherwise that gets added on to the length you're cracking.

None of this is very exact but it gets you in the right ballpark. And you can compare it to a password manager spitting out 20 character passwords that are completely immune to brute forcing.

Re: The Dropbox hack is real

#127

Post by iamdave »

jmknoll wrote: post #93
CookieMon wrote: post #80

Earlier quoted context omitted.

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

> giant iceberg of pwnage floating beneath the surface out of view Very poetic. I'd like to see this made into one of those motivational posters and hung in the office of every dev team nationwide.

The tip would be labelled "User Config", while the remaining behemoth, respectively: "DNS".

For the sysadmins out there ;)

Re: The Dropbox hack is real

#128

Post by aluhut »

rickycook wrote: post #35
aluhut wrote: post #12

Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it…

that's true, but 1p is far better than the open source options. it also has wifi sync between devices, so your fault never leaves your devices via anything but trusted, local connections if that's what you want

How is this "far better"? It's just some additional feature you've described here. I wouldn't need it. So it does nothing better for me as far as I can see it.

Re: The Dropbox hack is real

#129

Post by moonshinefe »

guitarbill wrote: post #82
tonyedgecombe wrote: post #71

Earlier quoted context omitted.

Why?

For me, it's that 1Password runs locally and doesn't need to phone home, whereas LastPass is "cloud". Also, LastPass being owned by LogMeIn doesn't sit right with me, but that's definitely personal. No idea about Keepass(x), although I found that ecosystem to be confusing, with different apps for different platforms you might accidentally download a rouge one on e.g. your phone. I know, paranoia.

LastPass is only "cloud" in the sense that it takes the AES encrypted files your browser encrypts locally, then allows you to access them from multiple locations if you have the right pw (and 2 factor auth if you use it).

Re: The Dropbox hack is real

#130

Post by Syzygies »

CookieMon wrote: post #80
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

I used to use unique middle addresses for magazine subscriptions, back when magazines were physical. I'd get credit offers with middle name "Byte". Consumer Reports used to include a false advertising hall of shame; I loved sending them an example sent to middle name "CR". They didn't use it, or even answer.
Post reply on HN