Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

181–190 of 557 posts

Re: The Dropbox hack is real

#181

Post by technion »

mmaunder wrote: post #28
willvarfar wrote: post #11

50% of the leaked hashes were bcrypt and the other 50% were salted sha1. So, asking the HNers who crack passwords or follow the tech closely and have a good feel: Salted sha1 can be brute forced much quicker, but in practical terms what kind of complexity of password is vulnerable today if it was stored salted sha1 vs bcrypt? And how can this be projected to change in the next couple of years?

The salts for the sha1 passwords weren't leaked. So they're hard to crack in practical terms. Depends how random they were. See hashcat docs and benchmarks for complete answers to your questions. The GPU versions of hashcat.

I think it's quite unlikely whoever took control of this managed to dump an entire database but couldn't access a password salt.

Do we know for sure these were "salted SHA"? It could well be "SHA1-HMAC through an HSM", and thus, actually be the stronger option.

Alternatively, someone has probably kept a lot of cracked passwords to themselves.

Re: The Dropbox hack is real

#182

Post by shostack »

tonicoto wrote: post #45
gowthamgts12 wrote: post #43

Why these troyhunt guys place a clickbait to hibp in every article? Don't be sick

Well, let's reply to the obvious troll. Troy Hunt is a person, not a team, and I guess he links to HIBP because he's proud of his work. I know I would.

You forgot to add that it is also an incredibly valuable service for times like these that is totally free.

At this point I'd say signing up for notifications with it is just a solid security practice.

Re: The Dropbox hack is real

#183

Post by ruraljuror »

znebby wrote: post #76
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

For credit cards, check out privacy.com I recently started using it, works great.

Nifty. Discover Card offers this--or at least did when I was using it.

Re: The Dropbox hack is real

#184

Post by berlam »

Sephr wrote: post #87
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

I've been using unique-per-service email addresses quite a while, and I maintain a list[1] of all offenders that have leaked my PII. 1. https://gist.github.com/eligrey/5084991

I also actively watch my unique-per-service email addresses but have not started with a list, yet. Might be a good idea.

Re: The Dropbox hack is real

#185

Post by Shank »

DominikSerafin wrote: post #174
chii wrote: post #162

Earlier quoted context omitted.

Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...

What can be better alternative? IMO using something like 1Password/Lastpass is less secure because it then only takes someone to get my master password to get all my other passwords.

Your master password shouldn't really be something that's going to be in either a dictionary, or brute forcible. Nobody is going to "get" it unless you make it insecure. If you're using their sync services, however (especially LastPass), you're more vulnerable to phishing attacks, and the vault can potentially be stolen and crack attempts run offline. However, both services use a heavy level of encryption that requires the passphrase to unlock, so as long as that's not dictionary based or brute forcible, you're totally fine.

Re: The Dropbox hack is real

#186

Post by berlam »

dividuum wrote: post #147
dvcrn wrote: post #137

Earlier quoted context omitted.

unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastm…

For gmail, if you have someone@gmail.com, you can just append +anything to your address like this: someone+anything@gmail.com. It will still end up in your mailbox without having to set up anything. See https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo... I would assume that google apps version of gmail offers something similar.

This feature is called sub-addressing, but it is also known as plus addressing or tagged addressing.

I also use it but some services do not allow the plus sign in their registration form. Very frustrating.

Re: The Dropbox hack is real

#187

Post by angry-hacker »

donw wrote: post #6

Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.

I also recommend authy. Makes 2fa slightly less painful.

Not a fault of authy, but namecheap and paypal both don't offer support.

I'm especially angry at namecheap because their homegrown 2fa solution is unreliable. Especially when travelling. I'm considering leaving them agter 4 years of promises to support authy but nothing!

Re: The Dropbox hack is real

#188

Post by aluhut »

cel1ne wrote: post #133
aluhut wrote: post #119

Earlier quoted context omitted.

> They are a company focussing on just one commercial product. Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Try keepass for excample. It's local too and it's open source.

> Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Actually it does. They depend on selling their product to security-savy users, so they will ensure it's quality.

> They depend on selling their product to security-savy users

No they don't. They just need some good advertising and they can sell to people who didn't even know they need it (fear works very well here). Really tech savy users will just move on if they don't like something or won't even come in because it's not open source or because of data thrift. The untechy customer will stick to what he has.

On the other side: if there is just one company better then them, with better advertising they'll have to see how they can get money with just this product. There are many creative solutions out there. A sheer endless horizon of possibilities I don't even want to think about.

Re: The Dropbox hack is real

#189

Post by tajen »

m0nty wrote: post #108
VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

Download a password manager like Keepass, Lastpass or Password Safe: https://en.wikipedia.org/wiki/List_of_password_managers I use Keepass, it does exactly what I need. Secure the password manager itself with a long password. Put your logins into it, and generate a unique random password for each one, then go to the website in question and change the password to the new one. When you want to login to that website, op…

Is Keychain Access from OSX a safe password manager?

Also, how comes all security-aware people trust 1Password and LastPass, even though they are not open source? Isn't that one of the rules of security, publish the source so we can trust it?

Re: The Dropbox hack is real

#190

Post by prawn »

rikkus wrote: post #166
dvcrn wrote: post #137

Earlier quoted context omitted.

unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastm…

My email is handled by Google Apps for Business, and I just use e.g. dropbox@hemsley.cc or facebook@hemsley.cc - and have everything come to my real mailbox. Nothing to set up when I want to sign up for a new site. LastPass stores the different email addresses. This works better than something+realaddress@gmail.com because many sites fail to handle/allow that 'format'.

I do this too. You get more spam with a catchall address, but Google get most of it. And there is no setup time lost with a new service - just use newservicename@yourdomain.com when signing up and you're away.
Post reply on HN