Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

231–240 of 557 posts

Re: The Dropbox hack is real

#231

Post by dbg31415 »

lloeki wrote: post #105
dbg31415 wrote: post #38

Why isn't Dropbox reporting this? I'd have more respect for them if they were more honest about this.

They sent both me and my wife an email a couple of days ago regarding this, and have a Help Center page[0] for it: Hi , We’re reaching out to let you know that if you haven’t updated your Dropbox password since mid-2012, you’ll be prompted to update it the next time you sign in. This is purely a preventative measure, and we’re sorry for the inconvenience. To learn more about why we’re taking this precaution, please v…

Thanks. Found the email in my junk folder. Cool, glad they sent something.

Re: The Dropbox hack is real

#232

Post by maaaats »

lloeki wrote: post #105
dbg31415 wrote: post #38

Why isn't Dropbox reporting this? I'd have more respect for them if they were more honest about this.

They sent both me and my wife an email a couple of days ago regarding this, and have a Help Center page[0] for it: Hi , We’re reaching out to let you know that if you haven’t updated your Dropbox password since mid-2012, you’ll be prompted to update it the next time you sign in. This is purely a preventative measure, and we’re sorry for the inconvenience. To learn more about why we’re taking this precaution, please v…

4 years late, though...

Re: The Dropbox hack is real

#233

Post by _asummers »

Spooky23 wrote: post #221
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Re: credit cards, unless you insist on using debit cards for some reason, who cares if they are compromised. If someone steals my credit card, AMEX has a problem. I'll take reasonable care, but I'm not going to generate transaction specific numbers or whatever unless there is a strong incentive to do so.

I wish that it was much easier to generate temporary credit card numbers for all transactions. Like upon entering real number it would generate one and swap it for you.

Re: The Dropbox hack is real

#234

Post by dbg31415 »

brohee wrote: post #201
berlam wrote: post #186

Earlier quoted context omitted.

This feature is called sub-addressing, but it is also known as plus addressing or tagged addressing. I also use it but some services do not allow the plus sign in their registration form. Very frustrating.

Rejecting addresses with a plus is to me a strong incompetence clue, so unless somehow unavoidable between two choices I chose the one allowing a '+'. Sometime I even fire a mail explaining people rejecting '+' how and why they lost my business...

I feel the same way. (=

Re: The Dropbox hack is real

#235

Post by vtbassmatt »

dvcrn wrote: post #137
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastm…

I used to use https://spamgourmet.com and was quite happy. You can create email addresses on the fly without doing anything in their UI: alias.number.account@spam gourmet.com. Alias is the per-site value, number is the count of emails you want to allow through before automatically routing the rest to /dev/null. I seem to recall an option to remove the numerical limit, too - once you trust the place you gave your address to.

Re: The Dropbox hack is real

#236

Post by Dayshine »

OJFord wrote: post #196
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well and they're so easy with Gmail - anything following a '+' character after your username (or alias, if using your own/company domain) will go to the same box, but keep the distinct address. Unfortunately, depressingly many sites validate email fields, and get it wrong - thinking '+' is not allowed. IMO it's not even worth trying to get an email regex (or other vali…

Except it's really obvious, and spammers can just remove the "+asd" section.

Re: The Dropbox hack is real

#237

Post by gwbas1c »

peteretep wrote: post #25

Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?

As long as your Dropbox password is unique, you're all set.

Re: The Dropbox hack is real

#238

Post by MandieD »

raverbashing wrote: post #212
cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

Is there a service (email host) that can give you "infinite email aliases"? (Yes, I know about the '+' in gmail, but I suspect the word is out on it)

A Small Orange does this cheerfully, even for the smallest shared hosting plan. You can then go into cPanel to configure a catch-all account for the domain you're using.

Biggest downside to ASO: you have to pay $7/yr extra on domain registrations to make them private. So I register with Hover and host with ASO.

Re: The Dropbox hack is real

#240

Post by _wp3r »

CookieMon wrote: post #80
0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

I would be interested to know if you use a provider or host your own email.

I mention that because most of the ISP do have re-targeting efforts.

Also it would seem more likely that your email provider is breached as opposed to lots of other companies/servers.

Post reply on HN