Slashdot Mirror
Dropbox Confirms Email Addresses Were Pilfered
bigvibes writes "A couple of weeks ago Dropbox hired some outside experts to investigate why a bunch of users were getting spam at e-mail addresses used only for Dropbox storage accounts. The results of the investigation are in, and it turns out a Dropbox employee's account was hacked, allowing access to user e-mail addresses."
This particular employee had a list of user emails stored in their Dropbox. To prevent future incidents, Dropbox is moving toward two-factor authentication.
In so many of these cases, the only reason anyone finds out that a site or service was hacked was that the hackers were nice enough to brag about it in public or leave some kind of obvious trail.
It makes one wonder: how much black hat hacking goes undetected? A small company isn't likely to have security experts on staff, and even if they do there's no guarantee those experts will catch every break-in.
There's no -1 for "I don't get it."
Okay so yes it's a good idea to have different passwords for each website, but given that the emails were obtained from a file held in a Dropbox employee's account I'm not sure why they are talking about it in the context of this break-in.
And yes, two-factor authentication would be very nice. Please do it using an already-existing system like YubiKey rather than make your own.
And why, pray tell, did this dropbox employee have a list of user email accounts stored in his dropbox?
Unless they run things rather differently than everybody else in the universe, user emails aren't exactly zOMG Super Secret; but they tend to reside somewhere in the bowels of the system for mailing-list and password reset purposes handled largely by automated tools, not in list form in human file storage areas. Outside of the relatively small number that might collect during the course of handling support requests or the like, why would an employee have any use for a substantial list of addresses, stored insecurely?
The normal way to implement this (a la Google) is to get your mobile phone number and when you want to login, they text you a secret phrase. You have to type this into the site, along with your normal password, to gain access. Note that you only have to do this every X weeks from each different computer you're logging in from, so you don't have to do it all the time. What it means is that you need to know the password *and* be able to receive texts sent to that phone number in order to login. If someone steals your phone, they shouldn't know the password, and if someone gets your password, they probably don't have your phone. Or at least it's less likely.
"I have never let my schooling interfere with my education." - Mark Twain
The employee used the same password for his work/dropbox account and some other website. That other website got hacked and the attackers got his password from that other site.
When the hackers tried his credentials on the dropbox site, they found his dropbox account used the same password and were able to access all the files he was storing which contained a list of names and email addresses.
They are mentioning using different passwords for different sites not because they are worried about your password but because it was how dropbox themselves got attacked.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
The whole thing is some kind of joke. Just forget for a moment that the employee used the same password on multiple sites..
Why in the hell did he have a list of customer email addresses in his account?
Is this a common practice there.. to let employees store copies of customer data all over the place?
I think dropbox has proven repeatedly they really don't care about the security of their customers data.
You'd think at least the dropbox people would be aware of how insecure dropbox is.
You let somebody in and they can always get in - changing the password doesn't change the key and only gives the illusion that you are locking people out.
Companies do try in earnest. I'd be willing to admit that bigger companies probably try a lot harder. Firms like Ebay are constantly training (and retraining) their employees on social engineering, document security, the risks of transferable media (e.g. USB drives), etc.
However, it is practically impossible for a company to put bulletproof safeguards around things like:
+ Laziness (opting for convenience vs. security)
+ Ignorance
+ Malice (intentional compromise of information)
+ Plain old human error
So the question really becomes, when has a company done enough...?
How do you know it was dropbox that let your address out?
I use spamgourmet to create unique email addresses for every site that wants my email address. I've used this for nearly 10 years and have created 616 different email addresses. The one I used for dropbox has never received spam, but I have gotten spam on the addresses I created for a samsclub rebate, and for the email address I used to make an account with Sony Online Entertainment, and on a few various other websites. These types of database cracks are common, and it really shouldn't be a news story.
I do not wish to advertise for the site mentioned above. As it stands now, google and yahoo mail both give the opportunity to make disposal email addresses now, so the service I use is no longer unique. But, I do recommend that everyone does use a service of this type, so that you can shut down only the addresses that you get spam with.
Free unix account: freeshell.org
Excuse me.. but please don't make up explanations and ask us all to pretend it's ok.
Dropbox says it was a project document with hundreds of customer email addresses.
I don't know about you, but I don't call my email client a "project document"
It wasn't the employees email that was hacked. An employees Drop Box account was hacked that had a file with client email addresses in it. They seriously need to create and enforce some rules on storing customer data.