Great, now only if they actually encrypted my files.
Spideroak works pretty well for me as a secure Dropbox replacement :-)
Dropbox Introduces 2-Factor Authentication
41–50 of 78 posts
Re: Dropbox Introduces 2-Factor Authentication
#42Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
I've never heard of Rublon before now, but this post has started me off with a pretty negative impression.
I'd suggest you work on your elevator pitch a bit more.
Re: Dropbox Introduces 2-Factor Authentication
#43Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/
This completely misses the point of Two-factor authentication, though.
Two-factor authentication is all about increasing security by combining two separate factors: something you know (password), and something you have (phone). From what I can tell, you're just switching from relying on one factor (password) to relying on the other factor (phone). It's just a different one-factor authentication paradigm.
Unfortunately, this leaves several gaps. For example, what happens when I lose my phone, or someone takes it from me? Can that other person log in immediately?
I can potentially understand an argument that this is more secure than solely password-based solutions (although I don't think it would be for me, where I use complex random passwords), but I certainly wouldn't consider it an alternative to two-factor authentication.
Re: Dropbox Introduces 2-Factor Authentication
#44Earlier quoted context omitted.
Put a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?
If Dropbox were designed to handle sequentially-numbered blobs of encrypted data, changing one file would require your other devices to download only that file (an encrypted blob of roughly the same size). With a TrueCrypt volume or other encrypted file solution on top of Dropbox, you have to resync the entire multi-GB volume any time a single file in there changes, since to Dropbox it's just one big file. (Another o…
Only part of a truecrypt volume changes when you make a change to the data within. Since Dropbox intelligently syncs files in parts, only part of a truecrypt volume has to be re-uploaded when something changes -- not the entire multi-GB file. I know because I do exactly this with a 1GB file. It takes about 2 minutes to sync when I unmount the file. Dropbox is not re-uploading all 1GB.
However, like the other commenter, I still recommend encfs for most uses.
Re: Dropbox Introduces 2-Factor Authentication
#45Hmm, but I can still simply open someone's Dropbox folder locally if they forgot to logoff/switch on their computer...
Re: Dropbox Introduces 2-Factor Authentication
#46Hmm, but I can still simply open someone's Dropbox folder locally if they forgot to logoff/switch on their computer...
That's hardly an unexpected security hole - most of my devices maintain local copies of everything in my Dropbox folder (phone/iPad excepted). Requiring password/two factor auth to get at the cloud hosted version of something in the local filesystem would achieve pretty much nothing.
Maybe there's people using Dropbox in some other fashion, but surely this is the intended/common use case?
Re: Dropbox Introduces 2-Factor Authentication
#47Earlier quoted context omitted.
How entering 6 digits hard for users?
You have to log in with your username and password first and then you have to enter another password (those digits that you're talking about). With Rublon you just scan a Rublon Code and that's it.
So you've invented one-factor authentication?
Re: Dropbox Introduces 2-Factor Authentication
#48More details: https://www.dropbox.com/help/363/en It looks like they support any app that uses the TOTP protocol, so google authenticator, among others, works with this seamlessly.
That's nice. A little context: TOTP is part of OATH - Initiative for Open Authentication - and is an open standard published as RFC 6238. For those who don't have iOS/Android/BB and/or don't want to use Google Authenticator, Wikipedia lists a few compatible applications: https://en.wikipedia.org/wiki/Google_Authenticator These work for Gmail too.
Is OATH related to OAuth?
Re: Dropbox Introduces 2-Factor Authentication
#49Re: Dropbox Introduces 2-Factor Authentication
#50Earlier quoted context omitted.
That's nice. A little context: TOTP is part of OATH - Initiative for Open Authentication - and is an open standard published as RFC 6238. For those who don't have iOS/Android/BB and/or don't want to use Google Authenticator, Wikipedia lists a few compatible applications: https://en.wikipedia.org/wiki/Google_Authenticator These work for Gmail too.
Is OATH related to OAuth?
nope! confusingly unrelated.