Slashdot Mirror
Evernote Security Compromised
starburst writes "Another online company has had its security compromised. Today Evernote posted on their blog that they're issuing a service-wide password reset because of suspicious activity on their network. They say an unknown intruder gained access to usernames, email address, and encrypted passwords. Even though the passwords were hashed and salted, they're doing the password reset as a precautionary measure. Nevertheless, it's a good reminder to keep a close eye on who you keep your data with in the cloud. Nothing is totally secure; it's always a compromise between security and convenience."
One more trendy company that didn't have a security program gets compromised. It's almost as if ignoring the problem doesn't make it go away. Pentest, code review, remediate, and test some more. Or, you know, lose brand value...that's the other option.
-- http://www.criticalassets.com
So that the government and whoever else wants to see your data has 24 hour access to it.
If you use a cloud service, use a layer of encryption that is under your control, e.g. truecrypt with dropbox. Problem is that is usually breaks the service. A possible alternative is to build your own cloud with OwnCloud. Note though that nothing as good as Evernote is yet available as a private server.
A picture is worth exactly 1024 words.
I tried to get my account deleted: the say they can't (!!!!). There's an option to "deactivate" my account. We need laws enforcing our right to disappear from a service.
La culpa no es del chancho...
If you don't know what it is, then you probably don't need to worry that it's been compromised. But if you absolutely must know, then it's literally the first page of hits on Google.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
Because if you haven't figured it out people are on average stupid idiots.
Take email encryption. After 20+ years there still isn't an easy to use way to send encrypted emails to anyone and get the appropriate security keys.
that means everyone is using plain text email still.
i thought once I was found, but it was only a dream.
What keys are you speaking about?
From TFA
In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed.
The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords.
Evernote has passwords, like just about every site. What you put on evernote is your business, but without additional layers of encryption most people don't put anything up there that is super secret. Most people use if for notes and stuff they need for quick reference on the go. Its a tool of convenience not a bank vault.
Sig Battery depleted. Reverting to safe mode.
It also used to be a "geek" site...
If you don't know what Evernote is, and if you can't use google, well maybe /. isn't the problem.
No, we're using Dropbox, Evernote, Google Drive and email with Truecrypt files. I tend to not use email for secure comms now; just edit a text file in a folder dropbox is configured to watch and as soon as you unmount the file it gets synced up and the recipient notified. I'd use Drive except it doesn't understand the concept of only syncing the part of the Truecrypt file which has changed, uploading instead the whole Truecrypt file. Even that would work for small files though.
You apparently don't know how most cloud storage systems work.
And you apparently don't have a clue about Evernote. Its not a "cloud storage" system.
Run along now sonny. I've got work to do.
Sig Battery depleted. Reverting to safe mode.