Evernote hacked

#1

Post by tlogan » Sat, Mar 02, 2013, 4:08 PM UTC

Re: Evernote hacked

#2

Post by mourique » Sat, Mar 02, 2013, 4:12 PM UTC

whew, i was shocked when my evernote client asked me to enter my password because i did not recieve the e-mail. It seems like this was a precautious step as nothing was 'really' hacked, or was it?

Re: Evernote hacked

#3

Post by rdl » Sat, Mar 02, 2013, 4:20 PM UTC

I've never really understood the security model for Evernote. It's "an exocortex" -- your personal notes, which are likely to be more security sensitive than general documents, email, etc. And yet they have even less security than Dropbox, themselves not exactly an exemplar of robust security.

They've got competent people operating the service; it's just not well designed for security.

Re: Evernote hacked

#4

Post by jms703 » Sat, Mar 02, 2013, 4:22 PM UTC

I don't understand why they don't offer encryption.

Re: Evernote hacked

#5

Post by MartinMond » Sat, Mar 02, 2013, 4:24 PM UTC

rdl wrote: post #3

I've never really understood the security model for Evernote. It's "an exocortex" -- your personal notes, which are likely to be more security sensitive than general documents, email, etc. And yet they have even less security than Dropbox, themselves not exactly an exemplar of robust security. They've got competent people operating the service; it's just not well designed for security.

Yeah, Evernote really should have been zero-knowledge end-to-end encrypted.

Recently https://crypton.io/ was released and my hope is that lots of new SaaS offerings will use it and that this will in the end force even the big names (Dropbox, 37signals, etc) to adopt real security.

Re: Evernote hacked

#6

Post by tlogan » Sat, Mar 02, 2013, 4:24 PM UTC

mourique wrote: post #2

whew, i was shocked when my evernote client asked me to enter my password because i did not recieve the e-mail. It seems like this was a precautious step as nothing was 'really' hacked, or was it?

Their blog is down now, but they did say that attacker had access to usernames and encrypted password but nothing else.

Re: Evernote hacked

#7

Post by Nyr » Sat, Mar 02, 2013, 4:25 PM UTC

And following the announcement, the blog it's down and emails didn't arrived yet. Well done, Evernote.

Re: Evernote hacked

#8

Post by kmfrk » Sat, Mar 02, 2013, 4:25 PM UTC

Service currently unavailable. Here is their latest tweet:

    Important: Evernote just implemented a service-wide
    password reset. Please read our post for details and
    instructions

Said post is unavailable by the look of it.

Can someone post a paste of the blog post in here?

Re: Evernote hacked

#9

Post by Ensorceled » Sat, Mar 02, 2013, 4:27 PM UTC

I'm kind of annoyed they didn't send an email, just flagged my password. So I couldn't use the iphone/mac apps and had to login via the web interface to reset. Which I didn't know because they didn't send an email, just got an invalid password error.

Their lack of encryption and lack of 2 factor auth just became a much bigger issue for me...

Re: Evernote hacked

#10

Post by UnoriginalGuy » Sat, Mar 02, 2013, 4:27 PM UTC

jms703 wrote: post #4

I don't understand why they don't offer encryption.

Encryption on /what/? Point to point or content encryption? Also if your password has been compromised and that same password is used to encrypt your data then what exactly would encryption do?