Slashdot Mirror
Evernote Security Compromised
starburst writes "Another online company has had its security compromised. Today Evernote posted on their blog that they're issuing a service-wide password reset because of suspicious activity on their network. They say an unknown intruder gained access to usernames, email address, and encrypted passwords. Even though the passwords were hashed and salted, they're doing the password reset as a precautionary measure. Nevertheless, it's a good reminder to keep a close eye on who you keep your data with in the cloud. Nothing is totally secure; it's always a compromise between security and convenience."
One more trendy company that didn't have a security program gets compromised. It's almost as if ignoring the problem doesn't make it go away. Pentest, code review, remediate, and test some more. Or, you know, lose brand value...that's the other option.
-- http://www.criticalassets.com
So that the government and whoever else wants to see your data has 24 hour access to it.
If you use a cloud service, use a layer of encryption that is under your control, e.g. truecrypt with dropbox. Problem is that is usually breaks the service. A possible alternative is to build your own cloud with OwnCloud. Note though that nothing as good as Evernote is yet available as a private server.
A picture is worth exactly 1024 words.
I tried to get my account deleted: the say they can't (!!!!). There's an option to "deactivate" my account. We need laws enforcing our right to disappear from a service.
La culpa no es del chancho...
Why people trust third parties with the keys to their data, I don't understand.
Why companies keep sprouting up that rely on holding the keys, I don't understand.
If you don't know what it is, then you probably don't need to worry that it's been compromised. But if you absolutely must know, then it's literally the first page of hits on Google.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
I only bring it up because Slashdot at least used to call itself a news site, and putting useful information like that in the summary is generally a good thing to do for a news site. "News" is often about things a person might not have a direct interest in. From a news point of view it's good to answer the basic questions of who, what, when, where, etc.
From the point of view of a site trying to derive revenue from ads, it's dumb to force people off the site to get that kind of basic information.
When people complain regularly about the declining quality of Slashdot, paying attention to little things like this can help a lot.
It's a bit like Notepad. but it saves teh dataz in teh cloud!
You can edit a text snippet on your smartphone and it will automagically synch it with your tablet that's a couple of feet away. It also does images. So the picture you took of your genital warts with your phone will instantly appear on your laptop. Nifty, huh?
20 minutes into the future
And here I was saying just last night how I wish there was an easier way to get picture of my genitals, warts and all, up into the cloud and back onto all my computers (and apparently everyone else's now).
And people say the era of specialization is over!
Nothing is forever secure.
If you don't know what it is, then you probably don't need to worry that it's been compromised.
It's nothing to do with who needs to worry and who doesn't. It's the difference between this:
Giorgio Napolitano has appealed to political leaders for "realism, a sense of responsibility" in resolving their post-election deadlock.
and this:
Italian President Giorgio Napolitano has appealed to political leaders for "realism, a sense of responsibility" in resolving their post-election deadlock.
on what is ostensibly a news site.
systemd is Roko's Basilisk.
See, all Slashdot had to do was put "Genital wart image storage service Evernote" and no-one'd be complaining.
systemd is Roko's Basilisk.
It also used to be a "geek" site...
If you don't know what Evernote is, and if you can't use google, well maybe /. isn't the problem.
Also, anyone who doesn't know what it is probably wouldn't care much about it if they did. I had a look at it to see what all the hype was about a few weeks ago, and it struck me as a solution looking for a problem. A simple text editor suits my purposes quite adequately. Though obviously, there are many who don't agree - which is fine, since it's all about freedom of choice.
Anyone who actually believes that such a service is somehow
"necessary" doesn't know how to manage information.
If this episode wasn't enough to convince you to avoid cloud
services, ask people who had Mobile Me accounts with Apple
how they enjoyed having their data disappear.
If the data matters, you need to be able to put your OWN hands
on the storage devices used, and keep the hands of those who
are not 100% trusted away.
Evernote makes it easy to synchronize text among all your computers and your phone too. I have things like my shopping list on there, so I can edit on either a desktop or while I'm out with the phone. It also allows some amount of formatting that's a pain get consistent in a simple text editor. I could use Markdown or something like that to do the same thing, but this is easier, and again the formatting also works on the phone.
It's ok to write "Today Twitter had ..." instead of "Today the popular microblogging platform Twitter had ...", it's not ok to do that for every Web 2.0 start up out there.
Following your logic to the very end, every article on /. can be simply replaced with lone headline reading "Some kinda stuff happened at $company". What, can't you just use Google to search for "what happened at $company?" if you want to know more? We could even add summaries consisting of LMGTFY links for those who can't.
> And Evernote Is?
I have no idea. Nor do I know what that "google" think is that everyone keeps talking about.
Yes - I've been on slashdot for many years, so I know what kind of site it's been.
I've been plugged into things of a geek nature for quite a long time and with a fair amount of breadth and this was the first I'd heard of Evernote. Nobody can keep up with every fly-by-night web service that pops up and then has security problems.
I'm just suggesting that if you're writing about something that is not as well known as Microsoft, Twitter, etc., and if your goal is to be a good news site, then it's probably worth spending an extra 20 characters saying what something is.
And sure, anyone can Google for it, but again, if your site is funded by ad revenue, one of the dumbest thing you can do is drive people to other sites to figure out what the heck you're writing about. People only have a limited amount of time to be on teh web. If you drive them off to Google or some other site during the that time when they could be on your site and now someone else is collecting those ad revenues.
With the passwords being salted and hashed, they are not easy to brute force. This means for any user who has chosen a reasonably strong password in the first place, a leak of the hashed password is not an issue at all. Those users could go on using the same password without being exposed to any additional risk. So why force them to change their strong password to something else?
I am all for them going public with what they found. But sometimes you really need to have enough confidence in your own protection of the passwords to not go and force everybody to change their password.
If the attackers had access to sniff the plaintext passwords at login, then it is a different story. But if there was only a leak of well protected hashes, then just let people know and let them decide if they want to change their password. It is not like a password reset is risk free either.
Do you care about the security of your wireless mouse?
I used to have an evernote account for some time, because my smartphone came with the app pre-installed as the official "note app". It's very good, nice UI, etc...
The only problem is that I'm FORCED to have an Evernote account to use it ! The syncing is done automatically by default if you don't disable it, come on... an account for a stupid note-taking app ? I understand we need it for the syncing feature but I really don't need to sync my stupid notes.
So, I stopped using it, forced to have an account just turns me off, no wonder why the hackers are interested in their datas.
Between my bank account, my Google account, my email account, my phone service provider account, my internet service provider account, my electricity account, I don't need a stupid note account, too many already, thanks...
So the attackers were able to get what sounds like direct access to the user database, or best case a backup copy, and yet we're expected to believe that the attackers couldn't gain access to the content database? (assuming it's even a different database) Or at least crack some really weak passwords within the two days before this was reported to users?
In this kind of attack, the baddies are after the content. The user accounts themselves are mostly worthless -- can't really use them for spam or phishing. But there's probably some dummies out there who have put sensitive information in Evernote, and that's what I'd guess the bad guys are after.
My guess is, Evernote has no frickin idea whether content was stolen or not, but they DO know that if they said that publicly they'd be in hot water.
It was only after I started organizing my shopping list on Evernote that I noticed a streak of insanity in myself.
There I was standing in front of a shelf in a shop. I noticed I forgot to put something onto my list. And I proceeded to append my Evernote list with the item I forgot to put on it.
The sane thing to do would of course have been to SIMPLY GRAB THE STUFF FROM THE SHELF and not bother with Evernote at all.
Therefore Evernote == insanity. And I'm better now.
20 minutes into the future
Well, it's more a why-should-I-care issue. If I don't know what evernote is (I've never heard of it) my immediate question is - why should I care? Why should I expend time and energy researching it. Is it a nuclear secrets site? Does the government store tax information there? Is a data breach important or unimportant? So far, I am not getting a sense of importance. This may be an advertising stunt to get people to investigate what evernote is.
Found this piece on possible Evernote alternatives: http://www.dsc.net/techtips/more-secure-alternatives-to-evernote. Bottom line, there really isn't anything with the same level of integration.
How can a hacker get to passwords and yet we are to believe that everything else has not been read ?
I considered using EverNote at one point, but my concern was offline availability (for personal use on my laptop) and security (for use at work). I didn't think management would be happy with me storing proprietary/confidential data on someone else's remote server, so I stuck with OneNote. (I also didn't realistically think they'd get broken into, to be honest, just thought it would be frowned upon. Sometimes paranoia works for you.)
I have looked into several open source alternate note-taking programs, but none of them worked for me as well as OneNote - some were too clunky, didn't have decent search, didn't do quick page hyperlinks, poor formatting, whatever. (Full disclosure: I used to work for Microsoft, which is where I started using OneNote - it was free for internal use - but I stuck with it after I left because it really is a great product.) I would be ecstatic to learn of a free/open source note-taking program that had parity with OneNote, but I haven't found one.