Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

441–450 of 557 posts

Re: The Dropbox hack is real

#441

Post by ss64 »

VeejayRampay wrote: post #81

Can someone in the know indicate how to BEST manage passwords for different services in a secure way in 2016? Should I be using password managers (à la 1Password, LastPassword and others), or use something like Keychain Access on Mac OS X (what are the Windows equivalents?), anything else? It's important to note that not everyone is well-educated on the matter, despite the fact that most people on HN are technical pe…

http://ss64.com/pass/ Download the page to your desktop and you can use it offline.

Re: The Dropbox hack is real

#442

Post by BinaryIdiot »

alxmdev wrote: post #437
BinaryIdiot wrote: post #432

Earlier quoted context omitted.

This scares the crap out of me. I have to remember this one, super long and complex password for my password manager. If I ever accidentally paste it somewhere else, type it in somewhere or somehow it's leaked from the password manager then I am completely screwed. This one, tiny thing can completely turn my life upside down. For sites that require security questions those are easy to game so the only way to be secur…

How about using the password manager to store security question answers too? It's mildly inconvenient because each site seems to require at least three, but then you wouldn't risk forgetting them and you could use random generated strings instead of having to make them up.

> How about using the password manager to store security question answers too?

That was my point: I use my password manager to store those security questions and answers but if someone got ahold of my password manager account I would be screwed because many sites require the answers to those questions to reset a password.

Re: The Dropbox hack is real

#443

Post by crypt1d »

jontas wrote: post #259
crypt1d wrote: post #145

Earlier quoted context omitted.

This looks pretty cool, but seems like they are invite-only for now... Any chance you can drop an invite for a fellow HNer? :)

I've got an invite, contact me via the email in my HN profile and I'll send it over.

I just checked their sign up page, turns out they are only available in the US for now :(

But thanks anyway!

Re: The Dropbox hack is real

#444

Post by Swizec »

Anagmate wrote: post #434
dsacco wrote: post #396

Earlier quoted context omitted.

Considering the consequences of password breaches, it's decidedly impractical. Password managers make it very easy to have unique passwords for all websites. I don't even know any of my passwords.

my approach to this consists of 4 security "levels": 1. I have one "throw away" password for services I don't give a fuck about 2. 2 passwords for ordinary services (breach cannot cause any serious harm and I can reset the password over my e-mail) 3. 2 other passwords (pretty easy to memorise but almost impossible to guess) that I use for my school mail, IDE, other mail accounts 4. a unique password coupled with two…

> as long as I have ownership of that, I can restore access to basically any other account I use

And therein lies the rub. Single point of failure for your whole intricate security setup.

I have the same problem.

Re: The Dropbox hack is real

#445

Post by curtfoo »

BinaryIdiot wrote: post #432
softawre wrote: post #411

Earlier quoted context omitted.

Except the one to your password manager :)

This scares the crap out of me. I have to remember this one, super long and complex password for my password manager. If I ever accidentally paste it somewhere else, type it in somewhere or somehow it's leaked from the password manager then I am completely screwed. This one, tiny thing can completely turn my life upside down. For sites that require security questions those are easy to game so the only way to be secur…

I use a pass phrase which is much easier to remember. I know the source material for my pass phrase so if I need to reconstruct my master password I go to the source material and convert it into the password by encoding the first letters, punctuation symbols and letters from the passphrase into the password.

I need to get into the habit of exporting my password list to plaintext csv and storing it in a safe or safe deposit box but I haven't disciplined myself for that yet.

I am worried about the ability for the 1Password database to be hacked if someone were able to get their hands on that.

Re: The Dropbox hack is real

#446

Post by loeg »

netule wrote: post #378
oxplot wrote: post #109

Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.

This was a strange way to find out that I have a Tumblr account.

Myspace and Adobe, neither of which is present in my password manager. Huh, no memory of those.

Re: The Dropbox hack is real

#447

Post by crummel »

peteretep wrote: post #25

Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?

Are 1Password's files not encrypted? Store it publicly on your web site, email it to your friends, print it out in base64 in a machine-readable font and keep copies pinned on the wall of your cube. You still have to remember one password but at least you're depending on crypto instead of Dropbox's security.

Re: The Dropbox hack is real

#448

Post by summarite »

zaroth wrote: post #203

> As for Dropbox, they seem to have handled this really well. I'm biased, but I can't agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2]. In 2012 they did not disclose that hashes were stolen, so I don't see how it's really relevant. In the latest communication, they don't actually explain the risk to the user. They say it is "purely as a preventa…

Horrible communication, much more important than to force a change on the site itself is to say to all users: look, your passwords are at risk, if you reused them change them now. All that in a way that non-techies can understand. Else we can all just wait for the millions of compromised accounts.

Re: The Dropbox hack is real

#449

Post by heartbreak »

nommm-nommm wrote: post #425
wrsh07 wrote: post #297

Earlier quoted context omitted.

You auth machines you use regularly so that login is 30 seconds once. That's not such a high penalty so that devices you've physically used are authorized and all others aren't.

I browse with tin foil hat settings so I authenticate multiple times a day.

Then you wouldn't complain about an extra few seconds for 2FA.

Re: The Dropbox hack is real

#450

Post by [deleted] »

ocdtrekkie wrote: post #335
dimino wrote: post #309

Earlier quoted context omitted.

It absolutely blows my mind that people are okay with giving their passwords (encrypted or not, see this very breach for why that's not always enough) to a 3rd party, but are not okay reusing a password somewhere. If 1Password ever got owned, the Internet would be severely fucked. And to stem the potential flood a bit, I realize there are plenty of good counterargument built up over the years to try and combat this g…

A great example was the recent Opera browser sync hack. Everyone who uses it has to change ALL of their passwords everywhere. Password managers are a TERRIBLE idea, and it's kinda sad so many security researchers recommend them. Single point of failure is a really basic concept to understand. Password reuse has been slightly overblown as a concern. Things like your Google, GitHub, TeamViewer, bank, etc. accounts shou…

[deleted]
Post reply on HN