The Dropbox hack is real

Post by dublinben » Wed, Aug 31, 2016, 2:10 PM UTC

rtpg wrote: post #92

wrboyce wrote: post #69

Earlier quoted context omitted.

I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now. The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which…

a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely I would recommend testing theories of : - losing phone - losing computer - losing both and have reasonable backup strategies for these scenarios.

Post by tmd83 » Wed, Aug 31, 2016, 2:13 PM UTC

znebby wrote: post #76

cm2187 wrote: post #40

Earlier quoted context omitted.

I cannot agree more, I do the same, and invite everyone else to do so. - Useful as a canary of which website has been breached - Useful as a canary of which website sold your details - and if your details are in the wild, you can stop the spam by deleting the address Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.

For credit cards, check out privacy.com I recently started using it, works great.

Post by arbitrage » Wed, Aug 31, 2016, 2:14 PM UTC

SixSigma wrote: post #198

CookieMon wrote: post #80

Earlier quoted context omitted.

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

Oddly enough I have had the opposite experience. I have been running per-service emails for 10 years and wonder to myself if it is worth the bother as I can recall only one ever spreading.

Post by inputcoffee » Wed, Aug 31, 2016, 2:16 PM UTC

CookieMon wrote: post #80

0x0 wrote: post #26

It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

Post by whateverdudes » Wed, Aug 31, 2016, 2:19 PM UTC

inputcoffee wrote: post #267

CookieMon wrote: post #80

Earlier quoted context omitted.

> Unique-per-service email addresses work pretty well as a canary for breaches I do this too, but it taught me everything is breached - the local ambulance service, the local computer store, the local car share, small businesses overseas that I've placed orders with. Some of the big names don't seem to be, which is lucky because otherwise I'd be wondering if it was the ISPs that had been breached. Either large chunks…

How do you guys do this? IS there a service? Do you add na.melast@gmail Or do you create them on your own domain through the hosting company?