Slashdot Mirror
Evernote Security Compromised
starburst writes "Another online company has had its security compromised. Today Evernote posted on their blog that they're issuing a service-wide password reset because of suspicious activity on their network. They say an unknown intruder gained access to usernames, email address, and encrypted passwords. Even though the passwords were hashed and salted, they're doing the password reset as a precautionary measure. Nevertheless, it's a good reminder to keep a close eye on who you keep your data with in the cloud. Nothing is totally secure; it's always a compromise between security and convenience."
One more trendy company that didn't have a security program gets compromised. It's almost as if ignoring the problem doesn't make it go away. Pentest, code review, remediate, and test some more. Or, you know, lose brand value...that's the other option.
-- http://www.criticalassets.com
So that the government and whoever else wants to see your data has 24 hour access to it.
If you use a cloud service, use a layer of encryption that is under your control, e.g. truecrypt with dropbox. Problem is that is usually breaks the service. A possible alternative is to build your own cloud with OwnCloud. Note though that nothing as good as Evernote is yet available as a private server.
A picture is worth exactly 1024 words.
I tried to get my account deleted: the say they can't (!!!!). There's an option to "deactivate" my account. We need laws enforcing our right to disappear from a service.
La culpa no es del chancho...
If you don't know what it is, then you probably don't need to worry that it's been compromised. But if you absolutely must know, then it's literally the first page of hits on Google.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
Because if you haven't figured it out people are on average stupid idiots.
Take email encryption. After 20+ years there still isn't an easy to use way to send encrypted emails to anyone and get the appropriate security keys.
that means everyone is using plain text email still.
i thought once I was found, but it was only a dream.
It's a bit like Notepad. but it saves teh dataz in teh cloud!
You can edit a text snippet on your smartphone and it will automagically synch it with your tablet that's a couple of feet away. It also does images. So the picture you took of your genital warts with your phone will instantly appear on your laptop. Nifty, huh?
20 minutes into the future
What keys are you speaking about?
From TFA
In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed.
The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords.
Evernote has passwords, like just about every site. What you put on evernote is your business, but without additional layers of encryption most people don't put anything up there that is super secret. Most people use if for notes and stuff they need for quick reference on the go. Its a tool of convenience not a bank vault.
Sig Battery depleted. Reverting to safe mode.
And here I was saying just last night how I wish there was an easier way to get picture of my genitals, warts and all, up into the cloud and back onto all my computers (and apparently everyone else's now).
And people say the era of specialization is over!
If you don't know what it is, then you probably don't need to worry that it's been compromised.
It's nothing to do with who needs to worry and who doesn't. It's the difference between this:
Giorgio Napolitano has appealed to political leaders for "realism, a sense of responsibility" in resolving their post-election deadlock.
and this:
Italian President Giorgio Napolitano has appealed to political leaders for "realism, a sense of responsibility" in resolving their post-election deadlock.
on what is ostensibly a news site.
systemd is Roko's Basilisk.
See, all Slashdot had to do was put "Genital wart image storage service Evernote" and no-one'd be complaining.
systemd is Roko's Basilisk.
It also used to be a "geek" site...
If you don't know what Evernote is, and if you can't use google, well maybe /. isn't the problem.
Also, anyone who doesn't know what it is probably wouldn't care much about it if they did. I had a look at it to see what all the hype was about a few weeks ago, and it struck me as a solution looking for a problem. A simple text editor suits my purposes quite adequately. Though obviously, there are many who don't agree - which is fine, since it's all about freedom of choice.
No, we're using Dropbox, Evernote, Google Drive and email with Truecrypt files. I tend to not use email for secure comms now; just edit a text file in a folder dropbox is configured to watch and as soon as you unmount the file it gets synced up and the recipient notified. I'd use Drive except it doesn't understand the concept of only syncing the part of the Truecrypt file which has changed, uploading instead the whole Truecrypt file. Even that would work for small files though.
Evernote makes it easy to synchronize text among all your computers and your phone too. I have things like my shopping list on there, so I can edit on either a desktop or while I'm out with the phone. It also allows some amount of formatting that's a pain get consistent in a simple text editor. I could use Markdown or something like that to do the same thing, but this is easier, and again the formatting also works on the phone.
It's ok to write "Today Twitter had ..." instead of "Today the popular microblogging platform Twitter had ...", it's not ok to do that for every Web 2.0 start up out there.
Following your logic to the very end, every article on /. can be simply replaced with lone headline reading "Some kinda stuff happened at $company". What, can't you just use Google to search for "what happened at $company?" if you want to know more? We could even add summaries consisting of LMGTFY links for those who can't.
They are log in keys. You already have those keys. They are your login passwords.
Sig Battery depleted. Reverting to safe mode.
Yes - I've been on slashdot for many years, so I know what kind of site it's been.
I've been plugged into things of a geek nature for quite a long time and with a fair amount of breadth and this was the first I'd heard of Evernote. Nobody can keep up with every fly-by-night web service that pops up and then has security problems.
I'm just suggesting that if you're writing about something that is not as well known as Microsoft, Twitter, etc., and if your goal is to be a good news site, then it's probably worth spending an extra 20 characters saying what something is.
And sure, anyone can Google for it, but again, if your site is funded by ad revenue, one of the dumbest thing you can do is drive people to other sites to figure out what the heck you're writing about. People only have a limited amount of time to be on teh web. If you drive them off to Google or some other site during the that time when they could be on your site and now someone else is collecting those ad revenues.
You apparently don't know how most cloud storage systems work.
And you apparently don't have a clue about Evernote. Its not a "cloud storage" system.
Run along now sonny. I've got work to do.
Sig Battery depleted. Reverting to safe mode.
With the passwords being salted and hashed, they are not easy to brute force. This means for any user who has chosen a reasonably strong password in the first place, a leak of the hashed password is not an issue at all. Those users could go on using the same password without being exposed to any additional risk. So why force them to change their strong password to something else?
I am all for them going public with what they found. But sometimes you really need to have enough confidence in your own protection of the passwords to not go and force everybody to change their password.
If the attackers had access to sniff the plaintext passwords at login, then it is a different story. But if there was only a leak of well protected hashes, then just let people know and let them decide if they want to change their password. It is not like a password reset is risk free either.
Do you care about the security of your wireless mouse?
So the attackers were able to get what sounds like direct access to the user database, or best case a backup copy, and yet we're expected to believe that the attackers couldn't gain access to the content database? (assuming it's even a different database) Or at least crack some really weak passwords within the two days before this was reported to users?
In this kind of attack, the baddies are after the content. The user accounts themselves are mostly worthless -- can't really use them for spam or phishing. But there's probably some dummies out there who have put sensitive information in Evernote, and that's what I'd guess the bad guys are after.
My guess is, Evernote has no frickin idea whether content was stolen or not, but they DO know that if they said that publicly they'd be in hot water.
It was only after I started organizing my shopping list on Evernote that I noticed a streak of insanity in myself.
There I was standing in front of a shelf in a shop. I noticed I forgot to put something onto my list. And I proceeded to append my Evernote list with the item I forgot to put on it.
The sane thing to do would of course have been to SIMPLY GRAB THE STUFF FROM THE SHELF and not bother with Evernote at all.
Therefore Evernote == insanity. And I'm better now.
20 minutes into the future
The sync is the point though, otherwise you might as well just use a local note app.
I use it for random technical notes, pointers to useful howtos, command line snippets I want to remember, ideas for my blog... nothing that requires much in the way of security. I like that I can write the notes at work and have them on my home PC, or jot an idea on my phone while I'm out and expand on it when I'm front of the keyboard. I was looking for a note app that let me organise notes into folders with a bit of markup. I'm sure plenty of them exist, but the sync is the killer feature for me.
Yes, to maintain my geek card I know I could use text files in a dropbox synced folder structure, or hack something together with some kind of rsync, but sometimes it's just easier to use a nice GUI app that just works.
Sigs are so 1990s. No way would I be seen dead with one.
The sync is the point though, otherwise you might as well just use a local note app.
A truly local note app is exactly what I want on my phone, for exactly the kind of security reason as this article highlights. I don't want my notes anywhere but in my pocket. That's why they're notes, not shared documents.
But no. Most note apps out there automatically sync my private notes to some "cloud service" whether I want to or not. So far the best option I've found has been to install an app which wants to sync to a service I don't have an account on. But that's a dumb workaround to a dumber misfeature.
Mobile and Cloud are two of the worst things that have happened to computer security at the moment. Far too many people are putting far to much data onto public storage with far too little privacy, and most of the time they're not even aware that it's happening. That's a problem, and eventually we're going to find out how much of a problem. But that will be long after the damage is done.
You are not a brain: http://books.google.com/books?id=2oV61CeDx-YC
I considered using EverNote at one point, but my concern was offline availability (for personal use on my laptop) and security (for use at work). I didn't think management would be happy with me storing proprietary/confidential data on someone else's remote server, so I stuck with OneNote. (I also didn't realistically think they'd get broken into, to be honest, just thought it would be frowned upon. Sometimes paranoia works for you.)
I have looked into several open source alternate note-taking programs, but none of them worked for me as well as OneNote - some were too clunky, didn't have decent search, didn't do quick page hyperlinks, poor formatting, whatever. (Full disclosure: I used to work for Microsoft, which is where I started using OneNote - it was free for internal use - but I stuck with it after I left because it really is a great product.) I would be ecstatic to learn of a free/open source note-taking program that had parity with OneNote, but I haven't found one.