Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dropbox hack is real

troyhunt.com

Post reply on HN
Print view View original

511–520 of 557 posts

Re: The Dropbox hack is real

#511

Post by x1798DE »

cm2187 wrote: post #502
dsacco wrote: post #396

Earlier quoted context omitted.

Considering the consequences of password breaches, it's decidedly impractical. Password managers make it very easy to have unique passwords for all websites. I don't even know any of my passwords.

I do not have the privileges to install a password manager on my work desktop PC. So that doesn't really work for me.

You probably shouldn't keep/use any personal passwords on your work computer anyway, but Keypass offers a portable executable that does not need to be installed.

Re: The Dropbox hack is real

#512

Post by johncolanduoni »

achr2 wrote: post #436
gshulegaard wrote: post #399

Earlier quoted context omitted.

Genuinely curious, but what do you think the severity is? Everything I know about it (this article included) places the Dropbox leak very low in my sense of severity.

The severity stems from the unfortunate fact that a password leak retroactively, and silently, destroys your security across all sites that use the same or a similar password. Even if you started using the longest, randomised, two-factor-authenticated password system last year, all those forgotten or seemingly unimportant accounts are suddenly exposed. Even when the exposed sites have minimal information or impact, m…

As far as what we know about these cryptosystems today, the passwords are no more accessible via this breach than they are when you send them over TLS. How is that severe at all?

Re: The Dropbox hack is real

#513

Post by randac »

cel1ne wrote: post #133
aluhut wrote: post #119

Earlier quoted context omitted.

> They are a company focussing on just one commercial product. Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Try keepass for excample. It's local too and it's open source.

> Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Actually it does. They depend on selling their product to security-savy users, so they will ensure it's quality.

> They depend on selling their product to security-savy users, so they will ensure it's quality.

This is a dangerously naive attitude.

Re: The Dropbox hack is real

#514

Post by MaulingMonkey »

tempestn wrote: post #440
achr2 wrote: post #436

Earlier quoted context omitted.

The severity stems from the unfortunate fact that a password leak retroactively, and silently, destroys your security across all sites that use the same or a similar password. Even if you started using the longest, randomised, two-factor-authenticated password system last year, all those forgotten or seemingly unimportant accounts are suddenly exposed. Even when the exposed sites have minimal information or impact, m…

That's true if your actual password is leaked, but as described in this post, it is very unlikely that actual passwords could be retrieved. Still a non-zero risk, but I could see a case that the severity of that risk is low. The significantly greater issue imo is the leaking of email addresses and ensuing spam.

> That's true if your actual password is leaked, but as described in this post, it is very unlikely that actual passwords could be retrieved.

If I'm interpreting the hashcat screenshot correctly (I'm probably not, and even if I am it's probably skewed by init overhead or by not counting the final result) it looks like passwords can be attacked at ~6ms/dictionary attempt against the bcrypt passwords? While HIBP didn't get their hands on salts for the SHA1s, that doesn't mean they weren't breached as well.

I take it as a given that all high value dropbox accounts with a weak password in this breach will be pwnt.

Then again, it took until last week for anyone to try and grab my Minecraft account (successful email change, but successful resecure.) Given that HIBP knew about 1 of the 4 breaches I'm aware of for similarly weak passwords, I'm surprised it took this long... (I've since finally gotten off my ass and better secured all the legacy old terribly passworded accounts I can think of / were listed in my password database...)

Re: The Dropbox hack is real

#515

Post by corobo »

garaetjjte wrote: post #507
oxplot wrote: post #109

Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.

I think it should hash entered email client-side in JS to be more trustworthy. I am a bit worried about giving my various email addresses to some random site.

If you don't trust it to keep your email safe why would you trust it when it says it's going to hash your address?

Also it's an email address, not your credit card number.

Re: The Dropbox hack is real

#516

Post by achr2 »

tempestn wrote: post #440
achr2 wrote: post #436

Earlier quoted context omitted.

The severity stems from the unfortunate fact that a password leak retroactively, and silently, destroys your security across all sites that use the same or a similar password. Even if you started using the longest, randomised, two-factor-authenticated password system last year, all those forgotten or seemingly unimportant accounts are suddenly exposed. Even when the exposed sites have minimal information or impact, m…

That's true if your actual password is leaked, but as described in this post, it is very unlikely that actual passwords could be retrieved. Still a non-zero risk, but I could see a case that the severity of that risk is low. The significantly greater issue imo is the leaking of email addresses and ensuing spam.

I think the risk is a lot higher than described by this post or dropbox. There are nearly 70 million credentials, and email addresses actually contain a fair amount of heuristic information for an attacker. For example just filter down to addresses from hotmail or yahoo, and suddenly you have a list of credentials that are far more likely to be susceptible to a dictionary attack.

Re: The Dropbox hack is real

#517

Post by wildflyalpha »

lllorddino wrote: post #248

> 1Password now has a subscription service for $3 a month and you get the first 6 months for free. Don't pay for this people. Use the open source password manager Keepass http://keepass.info/

I'd recommend something like LastPass instead.

I used KeepPass for a number of years and it's a fine piece of software. To solve the problem of access on multiple devices and keeping it in sync I kept my password database in Dropbox. It works reasonably well but you often run into "lock conflict" issues when it is open from multiple devices, fine if it's read-only but I always felt uneasy when making changes.

A few months back I switched to LastPass and although it's GUI takes some getting used to, I was able to import everything from KeePassX into it easily and de-dupe it.

It even has 2FA support via Google Authenticator so it's convenient.

There are also apps for Firefox, Chrome and Android (phone and tablet) so I forked out for a Premium license and I'm pretty happy.

You can get it to generate passwords for a new site, no fear of using the same password in multiple places and LastPass will warn you if that happens.

Re: The Dropbox hack is real

#518

Post by corobo »

hughw wrote: post #462
em3rgent0rdr wrote: post #459

Earlier quoted context omitted.

Anyway, tech-savvy folk are more likely to setup their own file-sync server. It is the non-tech-savvy people who are the primary users of dropbox.

Not many tech-savvy people have time to set up and maintain a personal file sync service that works across their laptops, phones, and tablets.

Second bit of data for that claim. I use dropbox because I can't be waffled to set up my own dropbox nor do I have the free time even if I did want to.

Re: The Dropbox hack is real

#519

Post by corobo »

astrostl wrote: post #298
paulgb wrote: post #284

Earlier quoted context omitted.

I have a wildcard redirect so that @mydomain.com is forwarded to me. That way whenever I sign up for a service I just use, e.g., dropbox@mydomain.com.

I used that practice, and ended up selling the domain. Updating everything was an absolute nightmare as a result, and I couldn't make a simple request like, "please forward my one primary email address to me for the next few years." YMMV :)

Don't sell your domain until you've done a search for "to:*@example.com" :)

Re: The Dropbox hack is real

#520

Post by _h8ft »

netule wrote: post #378
oxplot wrote: post #109

Make sure you sign yourself up for something like https://haveibeenpwned.com if you haven't already. Sometimes being timely in responding to leaks can make a big difference on any further leaks.

This was a strange way to find out that I have a Tumblr account.

I think there was a time when it was once considered a vaguely normal blogging platform.
Post reply on HN