Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Introduces 2-Factor Authentication

dropbox.com

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Dropbox Introduces 2-Factor Authentication

#51

Post by rdl »

mwww wrote: post #12

Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/

1) Screw outsourcing your authentication database to a third party, or incorporating third-party JS, as a mandatory thing. It's ok if you build something (like OATH) which allows a third-party service provider, but it shouldn't be mandatory; you should be able to implement the entire thing on your own infrastructure, and ideally play nicely with other sites in a user-selected client (potentially a browser).

2) I'd rather just do N-factor using a client cert stored in the web browser (mobile or desktop), combined with a password. x509 is probably terminally defective in desktop browsers due to historical accident and a messy protocol, but it could work on mobile, and stuff like OneID or BrowserID could meet the same need for regular browsers.

I don't believe in desktop + cellphone both being required to log into every site every time. The OATH compromise (using the phone periodically, along with a desktop password, and caching something in the browser) is an acceptable compromise for some apps.

Ultimately what I want is trusted keystore of asymmetric private keys on devices, and then multifactor auth to the keystore (biometric, password, location/time based heuristics, etc.), and reasonable management of keystores and keys (so I can for instance revoke every key on my phone if stolen, or disallow ipad and iphone but not mba13 for dropbox, but allow all 3 for linkedin)

The technical problem is relatively simple; it's an integration program (the auth libraries used by every site, plus mobile OSes, maybe desktop OSes, and hardware in phones and computers).

Give users the ability to make their own choices, and let sites establish minimum standards as well. I should be allowed to make a site depend on fingerprint swipe + physical location + specific machine if I want, but it shouldn't be mandatory for a random game site for everyone/anyone.

Re: Dropbox Introduces 2-Factor Authentication

#52

Post by mikhael »

Dylan16807 wrote: post #32
sliverstorm wrote: post #22

Earlier quoted context omitted.

The downside, of course, is no differential sync'ing. So, if you make a change to your volume, you must re-upload the entire volume. Worth doing for some files, yes, but still a pain. Per-file encryption would be ideal, but a monstrous pain to implement with TrueCrypt. Dropbox is probably not crazy about widespread encryption because it would eliminate their ability to perform deduplication. Perhaps they could get ar…

If you only change a few kilobytes, dropbox only has to upload a few kilobytes. I just modified a file in a 64MB truecrypt container and unmounted it. Dropbox took roughly five seconds to sync it. The only real problem with truecrypt in dropbox is that you can't keep it mounted on multiple devices.

You would also lose easy access to file histories, correct? This is one reason why I'm a fan of SpiderOak -- the index remains encrypted, but file histories are still stored (efficiently).

Re: Dropbox Introduces 2-Factor Authentication

#53

Post by guylhem »

SwaroopH wrote: post #4

Try this: https://www.dropbox.com/try_twofactor Although tray login still logs you in without the need to enter password or the code.

Not working for Martinique (FWI), country code 596. Still waiting for a SMS to come. Asked twice 5 and 10 minutes ago.

Maybe the country list should be edited to only list countries where SMS can be sent? (I have no problem with other 2-ways services I use)

Re: Dropbox Introduces 2-Factor Authentication

#54

Post by adgar »

mwww wrote: post #29
joshu wrote: post #28

Earlier quoted context omitted.

how is the phone not a second factor?

Rublon replaces passwords with cryptographic keys that are partially stored on your phone. This is a completely new approach to user authentication.

It's not a completely new anything, it's a password on your phone.

Re: Dropbox Introduces 2-Factor Authentication

#55

Post by jrockway »

joshu wrote: post #28
mwww wrote: post #12

Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com 7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/

how is the phone not a second factor?

Because there is no first factor. You don't log into Dropbox or Google with only your OTP, you use a password and OTP. With the method above, you scan a code with your phone instead of using a password or OTP.

Re: Dropbox Introduces 2-Factor Authentication

#56

Post by mceachen »

mapgrep wrote: post #20
matwood wrote: post #19

Earlier quoted context omitted.

Put a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?

If Dropbox were designed to handle sequentially-numbered blobs of encrypted data, changing one file would require your other devices to download only that file (an encrypted blob of roughly the same size). With a TrueCrypt volume or other encrypted file solution on top of Dropbox, you have to resync the entire multi-GB volume any time a single file in there changes, since to Dropbox it's just one big file. (Another o…

If you only have Macs, using an encrypted sparse bundle disk image is pretty simple, and changed files result in a small delta for dropbox to sync. It's built in and you'll be up and running in a couple minutes: http://matthew.mceachen.us/blog/free-easy-encrypted-storage-...

Re: Dropbox Introduces 2-Factor Authentication

#57

Post by Spooky23 »

matwood wrote: post #19
batgaijin wrote: post #9

Great, now only if they actually encrypted my files.

Put a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?

Consider what your goals are with respect to encryption -- allowing the deltas generated by modifying your TrueCrypt volume will almost certainly make it easier for an adversary to break into your encrypted volume.

Re: Dropbox Introduces 2-Factor Authentication

#58

Post by guylhem »

icebraining wrote: post #8
joshzayin wrote: post #6

More details: https://www.dropbox.com/help/363/en It looks like they support any app that uses the TOTP protocol, so google authenticator, among others, works with this seamlessly.

That's nice. A little context: TOTP is part of OATH - Initiative for Open Authentication - and is an open standard published as RFC 6238. For those who don't have iOS/Android/BB and/or don't want to use Google Authenticator, Wikipedia lists a few compatible applications: https://en.wikipedia.org/wiki/Google_Authenticator These work for Gmail too.

Tried adding something very close (RFC 2289) to busybox - discussion is still on http://comments.gmane.org/gmane.linux.busybox/36136

Finally gave up, considering how weird the idea seemed for most people. Glad that dropbox saw how interesting this is, especially in the light of the recent journalist hacks.

Hopefully, icloud will be next :-)

Re: Dropbox Introduces 2-Factor Authentication

#59

Post by dkokelley »

treelovinhippie wrote: post #45

Hmm, but I can still simply open someone's Dropbox folder locally if they forgot to logoff/switch on their computer...

That requires physical access, which is arguably more secure than internet access should your credentials be compromised. This is a major step in the right direction for Dropbox. I don't think it's Dropbox's job to encrypt and secure my local files. This would break many use cases, and there are other purpose-built solutions for this.

Dropbox made their business on an extreme convenience (your files everywhere through a dead-simple, familiar interface). Inconveniently, convenience is often the enemy of security. It's a "good thing" that Dropbox is now offering some granularity over the convenience/security spectrum.

Post reply on HN