Slashdot Mirror
Evernote Security Compromised
starburst writes "Another online company has had its security compromised. Today Evernote posted on their blog that they're issuing a service-wide password reset because of suspicious activity on their network. They say an unknown intruder gained access to usernames, email address, and encrypted passwords. Even though the passwords were hashed and salted, they're doing the password reset as a precautionary measure. Nevertheless, it's a good reminder to keep a close eye on who you keep your data with in the cloud. Nothing is totally secure; it's always a compromise between security and convenience."
One more trendy company that didn't have a security program gets compromised. It's almost as if ignoring the problem doesn't make it go away. Pentest, code review, remediate, and test some more. Or, you know, lose brand value...that's the other option.
-- http://www.criticalassets.com
So that the government and whoever else wants to see your data has 24 hour access to it.
If you use a cloud service, use a layer of encryption that is under your control, e.g. truecrypt with dropbox. Problem is that is usually breaks the service. A possible alternative is to build your own cloud with OwnCloud. Note though that nothing as good as Evernote is yet available as a private server.
A picture is worth exactly 1024 words.
I tried to get my account deleted: the say they can't (!!!!). There's an option to "deactivate" my account. We need laws enforcing our right to disappear from a service.
La culpa no es del chancho...
The summary would be much more helpful if it spent a few words explaining who/what Evernote is.
Why people trust third parties with the keys to their data, I don't understand.
Why companies keep sprouting up that rely on holding the keys, I don't understand.
Nothing is forever secure.
Anyone who actually believes that such a service is somehow
"necessary" doesn't know how to manage information.
If this episode wasn't enough to convince you to avoid cloud
services, ask people who had Mobile Me accounts with Apple
how they enjoyed having their data disappear.
If the data matters, you need to be able to put your OWN hands
on the storage devices used, and keep the hands of those who
are not 100% trusted away.
With the passwords being salted and hashed, they are not easy to brute force. This means for any user who has chosen a reasonably strong password in the first place, a leak of the hashed password is not an issue at all. Those users could go on using the same password without being exposed to any additional risk. So why force them to change their strong password to something else?
I am all for them going public with what they found. But sometimes you really need to have enough confidence in your own protection of the passwords to not go and force everybody to change their password.
If the attackers had access to sniff the plaintext passwords at login, then it is a different story. But if there was only a leak of well protected hashes, then just let people know and let them decide if they want to change their password. It is not like a password reset is risk free either.
Do you care about the security of your wireless mouse?
I used to have an evernote account for some time, because my smartphone came with the app pre-installed as the official "note app". It's very good, nice UI, etc...
The only problem is that I'm FORCED to have an Evernote account to use it ! The syncing is done automatically by default if you don't disable it, come on... an account for a stupid note-taking app ? I understand we need it for the syncing feature but I really don't need to sync my stupid notes.
So, I stopped using it, forced to have an account just turns me off, no wonder why the hackers are interested in their datas.
Between my bank account, my Google account, my email account, my phone service provider account, my internet service provider account, my electricity account, I don't need a stupid note account, too many already, thanks...
So the attackers were able to get what sounds like direct access to the user database, or best case a backup copy, and yet we're expected to believe that the attackers couldn't gain access to the content database? (assuming it's even a different database) Or at least crack some really weak passwords within the two days before this was reported to users?
In this kind of attack, the baddies are after the content. The user accounts themselves are mostly worthless -- can't really use them for spam or phishing. But there's probably some dummies out there who have put sensitive information in Evernote, and that's what I'd guess the bad guys are after.
My guess is, Evernote has no frickin idea whether content was stolen or not, but they DO know that if they said that publicly they'd be in hot water.
Found this piece on possible Evernote alternatives: http://www.dsc.net/techtips/more-secure-alternatives-to-evernote. Bottom line, there really isn't anything with the same level of integration.
How can a hacker get to passwords and yet we are to believe that everything else has not been read ?
I considered using EverNote at one point, but my concern was offline availability (for personal use on my laptop) and security (for use at work). I didn't think management would be happy with me storing proprietary/confidential data on someone else's remote server, so I stuck with OneNote. (I also didn't realistically think they'd get broken into, to be honest, just thought it would be frowned upon. Sometimes paranoia works for you.)
I have looked into several open source alternate note-taking programs, but none of them worked for me as well as OneNote - some were too clunky, didn't have decent search, didn't do quick page hyperlinks, poor formatting, whatever. (Full disclosure: I used to work for Microsoft, which is where I started using OneNote - it was free for internal use - but I stuck with it after I left because it really is a great product.) I would be ecstatic to learn of a free/open source note-taking program that had parity with OneNote, but I haven't found one.