I really hope they don't make 2fa mandatory. I hate most 2fa systems I've seen (I use Google Authenticator for one gmail account I have, and it makes life even more of a pain than it needs to, even just on Google properties). Having to reauth ~6 devices every month is obnoxious, and I already have a perfectly good password manager with long random per-site passphrases, plus secure storage of my key file and a strong memorized passphrase for it, unlocking sets of passwords only on certain machines. 2fa, particularly a naive version involving SMS or telcos, would make my security worse.
Dropbox: Security update & new features
51–60 of 69 posts
Re: Dropbox: Security update & new features
#52"A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses." I see two ways to read this. a) An employee happened to have a personal Dropbox account, and it was that personal account that was hacked, in exactly the same manner as the other accounts referenced. The employee probably used a different password on Dropbox's internal systems, and as a res…
Why would an employee have work-related data in a personal dropbox account?
Re: Dropbox: Security update & new features
#53I hope Dropbox uses google's authenticator. It supports multiple accounts and won't clutter up my phone. http://code.google.com/p/google-authenticator/ Their "Such as" example makes it seem they only decided to use 2-factor but haven't chosen an implementation yet.
The one thing I'm missing from this thing is to be able to export the data. Migrating from one device to another is painful as it is..
Edit: I was annoyed so long by this missing feature and - never did something myself. My bad.
If you have the same problem (one device paired with a couple of services, you want to migrate the accounts):
'/data/data/com.google.android.apps.authenticator2/databases' contains the sqlite3 file 'databases', which contains a table 'accounts' with your keys (and counter values, if necessary).
Re: Dropbox: Security update & new features
#54Earlier quoted context omitted.
Someone would need to not only have possession of your phone, but your password as well. So for a hacker to work this: First, get your password. Second, find your location. Third, steal your phone, which for most people, is almost always on their person. Finally, crack whatever security mechanism you have on your phone. For someone to go through all that trouble ... you must be storing some very valuable info. If tha…
well most "security mechanisms" on phones are a joke.
The point isn't the security mechanism, but for consumer products the point is physical location. Without two factor authentication, a sweat shop in China could hack you (and thousand others) easily. With two-factor authentication they would need physical proximity to you, so they won't even try.
Re: Dropbox: Security update & new features
#55This remark may be OT but why use a grey font on a white background?!? This makes the blog very difficult to read. Please don't do that.
Re: Dropbox: Security update & new features
#56Earlier quoted context omitted.
If the number of salts used in the system is equal to the number of users, this could be expensive.
Assuming they use straight up salted sha256, my five year old core2 laptop does at least 10,000 per second, per core. They could check every user for the top 10k passwords for a few hundred bucks of EC2 time.
Why do you assume that?
Re: Dropbox: Security update & new features
#57I hope Dropbox uses google's authenticator. It supports multiple accounts and won't clutter up my phone. http://code.google.com/p/google-authenticator/ Their "Such as" example makes it seem they only decided to use 2-factor but haven't chosen an implementation yet.
A password as secure as my phone is not promising; T-Mobible was recently happy to reset my lost PIN by having me give the last four digits of any phone number I'd dialled in the last 23 hours. I don't really think it's as useful two-factor because the token is only as secure as another company's password system. (Aside from the problems that you have to have a Google Account and a smartphone.) I looked into this rec…
[deleted]
Re: Dropbox: Security update & new features
#58"In some cases, we may require you to change your password. (For example, if it’s commonly used or hasn’t been changed in a long time)"
Commonly used? What do they mean by that? Aren't they supposed not to know my password?
Re: Dropbox: Security update & new features
#59IMHO confirms this incident the value of having an individual mail address for each site, service etc.
Gmail has allowed for such individual mail addresses for years:
username+loremipsum@gmail.com
Example:
johndoe+dropboxcom@gmail.com
Mails addressed to johndoe+dropboxcom@gmail.com will be delivered to johndoe@gmail.com. They are easy to identify, filter etc.
Re: Dropbox: Security update & new features
#60Good, solid response to the intrusion. I'm particularly happy about the two-factor opportunity. I have no problem re-authenticating every 60-90 days with an SMS sent to my phone, and _definitely_ want any new system to be two-factored before having access to my Dropbox.
The only issue is that a lot of programs (mobile apps, especially) seem to interact directly with the Dropbox API, which leaves no possible interface for a secondary authentication. Google gets around this by having app-specific passwords that you can generate and de-authenticate at will; it'll be interesting to see how Dropbox handles it.
Good point, and perhaps the reason they're taking some time to roll it out.