good reminder to enable 2fa on my dropbox account. Whoops.
A recent security incident involving Dropbox Sign
21–30 of 76 posts
Re: A recent security incident involving Dropbox Sign
#22Earlier quoted context omitted.
OK, so there is no fundamental obstacle for providing true e2ee.
Of course there isn't, but it limits efficiency and features. For example, you will miss all the fancy features Google Images does in cloud and user experience might be slower, since everything must be processed and downloaded on client side. Some level of metadata is always unencrypted.
That's trading one feature for a bunch of others. Users should have the choice of what features they think are important.
Re: A recent security incident involving Dropbox Sign
#23good reminder to enable 2fa on my dropbox account. Whoops.
Seems like they got the 2FA keys as well[0], so I'm not sure how useful this is in this context. 2FA seems it might be more useful where it's a different site and you've reused the password or had it phished, than in this case where the site is compromised.
I'm still unclear how much I'm impacted. I've used Dropbox Sign / HelloSign but always with my dropbox account. Resetting password and 2FA anyway, because why not.
[0]: They're asking people to reset the 2FA.
Re: A recent security incident involving Dropbox Sign
#24Earlier quoted context omitted.
I use Proton Drive [1], they offer e2ee but I agree with you: the Dropbox app experience is probably still the best. [1] https://proton.me/drive
OK, so there is no fundamental obstacle for providing true e2ee.
Was the question whether or not it is hypothetically possible to provide an E2EE storage service? Surely you can apply your engineering chops here. Of course it isn’t. But there are trade-offs, as with literally any engineering choice.
Re: A recent security incident involving Dropbox Sign
#25[flagged]
Re: A recent security incident involving Dropbox Sign
#26Earlier quoted context omitted.
Hashed passwords? Surely they mean hashed and salted passwords. Right? Right???
They were using SHA1, then they migrated. 68 million accounts dumped: https://www.theguardian.com/technology/2016/aug/31/dropbox-h... https://www.troyhunt.com/the-dropbox-hack-is-real/ now they first hash the password using SHA512 (with a per-account salt) then they hash the password with bcrypt (with the default strength) then they encrypt the password with a key that the application server runs with, but that is no…
This hack seems to affect the Dropbox Sign application, which is based on HelloSign which they acquired a few years ago. It’s still running on the hellosign.com domain and seems mostly separate, so it wouldn’t surprise me if they also store passwords differently.
Re: A recent security incident involving Dropbox Sign
#27I love Dropbox but stuff like this is a good reminder to re-evaluate using any service that store large amount of personal data without e2ee. I understand that partly because of block-level diffing and syncing, it's hard to provide true e2ee for Dropbox, but it's still a big reason why I'm having most of my stuff in iCloud Drive (with Advanced Data Protection), despite liking Dropbox much more. Hope they'll come arou…
Dropbox offers end-to-end encryption now (for business teams): https://blog.dropbox.com/topics/company/new-solutions-to-sec...
I'm not a business, I'm a paying customer on the most expensive personal tier. It's silly that they don't offer this feature for me. I also can't upgrade to a business plan because those require at least 3 users.
It just feels like feature gatekeeping to me, but no way for me to pay more to get this feature. But I also understand that personal users are not Dropbox's main focus.
Re: A recent security incident involving Dropbox Sign
#28At least it's a hack this time, it's not like when they forgot to enable authentication and you could sign-in to any Dropbox just by entering the e-mail. https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
Discussed on HN:
https://news.ycombinator.com/item?id=2678576 (46 comments)
Re: A recent security incident involving Dropbox Sign
#29Earlier quoted context omitted.
Dropbox offers end-to-end encryption now (for business teams): https://blog.dropbox.com/topics/company/new-solutions-to-sec...
I'm not a business, I'm a paying customer on the most expensive personal tier. It's silly that they don't offer this feature for me. I also can't upgrade to a business plan because those require at least 3 users. It just feels like feature gatekeeping to me, but no way for me to pay more to get this feature. But I also understand that personal users are not Dropbox's main focus.
Apple does offer this
Re: A recent security incident involving Dropbox Sign
#30At least it's a hack this time, it's not like when they forgot to enable authentication and you could sign-in to any Dropbox just by entering the e-mail. https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
And here I am, thinking that pushing bad CSS is going to end it all for me.