I do believe that all this kurfuffle originates from a 'false package deal' composed by: factual data (we store passwords), your assumptions about our incompetence (we're bound to lose them), and your subjective valuation of risk vs. convenience. You should not feel bad about other people breaking down the argument in the different topics. I am a Dropmyemail employee who works hands on with the security of the site, although I'm replying on my personal capacity. We don't practice security through obscurity so we can discuss the technicalities of our security measures here. I would appreciate not being treated as an incompetent goon though, to keep things friendlier. I see on this thread you accuse someone of being sent by the company I work for to discredit you personally: They did not, furthermore, I personally see your article as a valuable service, you will see in our site that we try to be as transparent as possible, and there's nothing that I could want more than for people to actually know and understand what Dropmyemail is about. Thanks for your article.
Dropmyemail's security
21–30 of 34 posts
Re: Dropmyemail's security
#22I do believe that all this kurfuffle originates from a 'false package deal' composed by: factual data (we store passwords), your assumptions about our incompetence (we're bound to lose them), and your subjective valuation of risk vs. convenience. You should not feel bad about other people breaking down the argument in the different topics. I am a Dropmyemail employee who works hands on with the security of the site,…
i'm not assuming you are incompetent. what i'm saying is that no system is fully secure, and by saving the users' passwords, you are risking them.
one of the first rules i learnt in web development is this, you do not store passwords. (http://www.codinghorror.com/blog/2010/12/the-dirty-truth-abo...) you never assume that your system will be so secure that no one can hack it.
Re: Dropmyemail's security
#23I do believe that all this kurfuffle originates from a 'false package deal' composed by: factual data (we store passwords), your assumptions about our incompetence (we're bound to lose them), and your subjective valuation of risk vs. convenience. You should not feel bad about other people breaking down the argument in the different topics. I am a Dropmyemail employee who works hands on with the security of the site,…
i'm not assuming you are incompetent. what i'm saying is that no system is fully secure, and by saving the users' passwords, you are risking them. one of the first rules i learnt in web development is this, you do not store passwords. ( http://www.codinghorror.com/blog/2010/12/the-dirty-truth-abo... ) you never assume that your system will be so secure that no one can hack it.
Indeed, no system is fully secure, and we don't try to hide that fact, that's one of the reasons Dropmyemail exists in the first place. We offer people an off-site backup at the cost of trusting a third party with their password. This is a risk assessment discussion, and I believe although good for raising awareness about what dropmyemail offers, the original articles fails to make a distinction between the objective information it provides and what are your personal valuations on the risk involved (for example, it assumes one of the worst possible scenarios regarding our competence). Things get a bit confusing when non security related topics like storage capacity are mixed in though. I believe you are trying to help people to be safe and choose the better tool to solve their problem, I do think you are underestimating them a bit, but in case I'm wrong I repeat how valuable your article is in raising this issues.
Re: Dropmyemail's security
#24Earlier quoted context omitted.
i'm not assuming you are incompetent. what i'm saying is that no system is fully secure, and by saving the users' passwords, you are risking them. one of the first rules i learnt in web development is this, you do not store passwords. ( http://www.codinghorror.com/blog/2010/12/the-dirty-truth-abo... ) you never assume that your system will be so secure that no one can hack it.
Indeed, no system is fully secure, and we don't try to hide that fact, that's one of the reasons Dropmyemail exists in the first place. We offer people an off-site backup at the cost of trusting a third party with their password. This is a risk assessment discussion, and I believe although good for raising awareness about what dropmyemail offers, the original articles fails to make a distinction between the objective…
And again, I am not doubting your competence. What I am saying is that we are all humans. Google might have hired the best computer scientists around the world but they still got hacked. It might even be a problem with the programming language you are using (rmb mass assignment on ROR?)
"We offer people an off-site backup at the cost of trusting a third party with their password."
Yes, this is my main point. People have to learn that they shouldn't be giving out passwords to just about anybody.
I think this guy in the comments here (http://blog.geeksphere.net/2012/09/27/response-to-dropmyemai...) made a pretty good point. Maybe you might want to answer his doubts there?
Re: Dropmyemail's security
#25Earlier quoted context omitted.
Indeed, no system is fully secure, and we don't try to hide that fact, that's one of the reasons Dropmyemail exists in the first place. We offer people an off-site backup at the cost of trusting a third party with their password. This is a risk assessment discussion, and I believe although good for raising awareness about what dropmyemail offers, the original articles fails to make a distinction between the objective…
And again, I am not doubting your competence. What I am saying is that we are all humans. Google might have hired the best computer scientists around the world but they still got hacked. It might even be a problem with the programming language you are using (rmb mass assignment on ROR?) "We offer people an off-site backup at the cost of trusting a third party with their password." Yes, this is my main point. People h…
I fail to see the point made by that commenter that has not been made yet in this thread, other than the funny accusation of malice. We don't store plaintext passwords, and we are very aware of mass assignment bugs. (being suspected of such naive practices is why I mentioned the incompetence thing earlier). If security is a chain, then we strive not to be the weakest link. People have to learn what's the risk involved in giving out their password, how to evaluate who they give it to, and then make their own choice regarding whether they want to give it away or not. I get my hopes high when I read that you wouldn't mind people giving their password to a company that is better than 'just about anybody'. Convincing people that we are trustworthy was a big initial challenge for us, and still is as we reach out to more and more users.
Re: Dropmyemail's security
#26Wow, either the author has a serious grudge against them, or isn't willing to at least fact-check their response. - The app checks your email on your behalf. - You need the actual password to log into an IMAP server (android also stores your email passwords in clear text if you aren't using gmail http://code.google.com/p/android/issues/detail?id=10809 ). - They clearly state this in their response, which the article…
in fact, seeing how your account was created to post that comment and seeing how it doesn't make sense, i would suspect that you actually work for them.
I don't post on HN often, and forgot the username I used last
time I posted. I don't work for them.
Personally, I don't see a strong use-case for the product and it wouldn't be something I'd be interested in.
If I did work for them, I would happily mention it in a post.
Re: Dropmyemail's security
#27Wow, either the author has a serious grudge against them, or isn't willing to at least fact-check their response. - The app checks your email on your behalf. - You need the actual password to log into an IMAP server (android also stores your email passwords in clear text if you aren't using gmail http://code.google.com/p/android/issues/detail?id=10809 ). - They clearly state this in their response, which the article…
I'm the author. 1) The app downloads your emails into their server. 2) Yes, they store that actual password. Which is ridiculous. 3) Yes, good for them for that, but still there are others where they store passwords. And that is not acceptable. 4) But that also means that they outsource the security part of things. Which doesn't lend faith to the idea that they know about security. And if someone realises how to cont…
> The app downloads your emails into their server.
They need to do that to back up the emails. The product may not be something you are interested in, but it doesn't mean the execution is flawed.
> Yes, they store that actual password. Which is ridiculous.
They have to in order to retrieve the emails. Blame the standards!
> Yes, good for them for that, but still there are others where they store passwords. And that is not acceptable.
See above
> But that also means that they outsource the security part of things.
> Which doesn't lend faith to the idea that they know about security.
> And if someone realises how to control their application, all the passwords will be hacked.
This isn't something with a black and white answer and I respect your opinion on this. I personally feel that they may know plenty about security and have decided that this is the most secure option. For example, I wouldn't write my own crypto, because I know enough about security to know how hard it is to do right.
Re: Dropmyemail's security
#28This article is nonsense. The author isn't saying anything substantive about the "security" of this particular company. It should go without saying that email backup services will currently, in most cases, need to store your email login information in a retrievable way. A slightly better post might have been, "Beware unproven email backup services. Don't forget that if they make a mistake, potentially all of your ema…
so you do concede that it can get ugly really fast.
That's a value judgement you have to make, similarly to using any service hosted by someone else.
1) Is the potential loss of privacy worth the advantages of the service?
2) Do you trust the company providing the service?
3) Could you do a more secure job of it than the company?
It's not a service I would personally use, but I have no reason to think the company providing the service doesn't know what they are doing.
Re: Dropmyemail's security
#29I do believe that all this kurfuffle originates from a 'false package deal' composed by: factual data (we store passwords), your assumptions about our incompetence (we're bound to lose them), and your subjective valuation of risk vs. convenience. You should not feel bad about other people breaking down the argument in the different topics. I am a Dropmyemail employee who works hands on with the security of the site,…
> you accuse someone of being sent by the company
> I work for to discredit you personally
If this refers to me, I was not attempting to discredit anyone.
I wanted to ensure people didn't think this was another "they store passwords in plain text because they don't know what a hash function is" stories we see every few days.
If you are interested in password security, why not write an article about Tesco?
Re: Dropmyemail's security
#30Earlier quoted context omitted.
And again, I am not doubting your competence. What I am saying is that we are all humans. Google might have hired the best computer scientists around the world but they still got hacked. It might even be a problem with the programming language you are using (rmb mass assignment on ROR?) "We offer people an off-site backup at the cost of trusting a third party with their password." Yes, this is my main point. People h…
I fail to see the point made by that commenter that has not been made yet in this thread, other than the funny accusation of malice. We don't store plaintext passwords, and we are very aware of mass assignment bugs. (being suspected of such naive practices is why I mentioned the incompetence thing earlier). If security is a chain, then we strive not to be the weakest link. People have to learn what's the risk involve…
yea, you are now aware of the mass assignment bugs, but what about previously? even github got affected by it. are you saying that they are incompetent? what about bugs that have yet to be revealed?
what i am saying is that there may be some things that you forget about, because we are all humans. and in order to mitigate the risk from us being humans, we should not store passwords in a way that is easily recovered.