Slashdot Mirror
Dropbox Adds Two-Factor Authentication
angry tapir writes "File-sharing service Dropbox is now offering two-factor authentication, a system that makes it much harder for hackers to capture valid credentials for a person's account. Dropbox, one of the most widely used web-based storage services, said last month it planned on introducing two-factor authentication after user names and passwords were stolen from another website and used to access accounts."
It's cloud storage. Calling it file-sharing will get it confiscated by the Feds.
I put my Dropbox Emergency key in Google Drive, and my Google Emergency Key in Dropbox. This should work out perfectly.
Dropbox ...said last month
What, a month long NDA, because release date is today, or what is the story on the delay?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Someone will hack them and will export the shared secret used for RFC 6238 TOTP: Time-Based One-Time Password Algorithm. Two factor authentication job is to protect the user, It doesn't make Dropbox security practices better, and they already demostrated are bad
$ apt-cache search google authenticator
libpam-google-authenticator - Two-step verification
It's in Debian repositories (And probably Ubuntu.) You can download it yourself and integrate it into anything that supports PAM.
I have my code on both my phone and iPod touch so I always have something on me that can generate the code. The 'backup codes' are in a safety deposit box with other documents. Not sure if it actually is secure but it feels a bit more secure knowing that to get into my home server you have to have both my password and one of my devices. (And if I lose one I can easily generate a new key).
It makes a QR-code in the bash terminal that you can take a picture of with your devices.
There's a lot of data people need to sync and share that is confidential enough that you don't really want it to leak out, but still not that secret that it's the end of the world if it does. You know, the kind of data you would be perfectly comfortable letting a reasonably big and relatively trustworthy service manage for you.
And if that service gets even more secure, you can rest easy knowing that if the data does leak out, it's not because you where careless with your passwords, and thus you have someone else to blame.
By now Dropbox have a proven track record of security and reliability. Yes, it was apparent that they themselves could get at the data if they needed, but I fail to see how it would work otherwise. At least with this, you can be somewhat safer knowing that it would take more than hack your account at some other, less secure service, to get at the data, just because you like to reuse passwords.
Great, but is it still the case you can just copy %APPDATA%\Dropbox\config.db to any computer and have instant access with no visibility that the credential is being double-used and no way to revoke or invalidate it?
http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/
Why would someone implement a keystroke logger if they can just steal this file and have unlimited future access with complete stealth? Sounds like this just makes it harder to remotely brute force against DB servers to login.
Back when OpenID was popular the argument was that you can outsource your authentication to a service that actually has a clue about security. Back then, though, none of the popular identity providers actually did anything better than username/password. (With the exception of MyOpenID, but they were always kinda niche.)
Now that I've embraced Google's two-factor auth -- accepting a little inconvenience for a little more security -- I find it useful that when I log into Google properties I only need to do the two-factor stuff once in a while, rather than for every single service. Two-factor auth *is* less convenient, but if you have single sign-on then you can make it less so.
If the latest trend is for every service to implement its *own* two-factor auth then this is going to get much less convenient. I'd sooner see services like DropBox just integrate with Google's auth (and with anyone else who has a decent auth system) and let users benefit.
I'm the only one that looses his phone?
a couple ways this works
1 the public folder: you can send a link to a file in your dropbox to anybody
2 if both of "us" have dropbox accounts then i can share a folder to you and anything i put in you get and anything you put i i get (i think editing files is a bit wonky but...)
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Dropbox adds a much better user identification method, for the sake of privacy.
As the second factor is an SMS, and because in all countries the law requires the mobile operator to be able to identify at any time who's the person using a certain SIM.
Identification of a user based on her/his email address is trivially uneffective.
Better security is a tiny side effect. Any techie of the VAS team at the mobile operator would be able to circumvent that method. As well as law enforcement men in black.
Really better security would be a cryptographic certificate locally protected by a password, a-la SSH.
Ah!
P.S.
Google is already willing to know your mobile phone number since long now.
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Great. Now how about some encryption? I notice that the one useful feature most of these services (purposely?) omit is client side [de|en]cryption with the client holding the keys. Why is that?
/tinfoil
Do these online storage services actually data mine their customers' files?
You're talking about Dropbox, the service that accidentally during a code push made it so that a user's password wasn't needed to get at their Dropbox files, and managed to get an extract from their user database stolen. I don't call that "a proven track record of security and reliability", unless you mean a bad track record.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Um, in almost no countries is it law that the mobile operator has to know who the customer is. Here, we can just buy a prepay SIM for $10 at the supermarket, put it in the phone, and start calling. No ID needed. Your post is a huge crock of shit.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".