Opera Sync Users May Have Been Compromised In Server Breach (fortune.com)

An anonymous reader writes: Someone broke into Opera's servers. The Opera browser has a handy feature for synchronizing browsing data across different devices. Unfortunately, some of the passwords and login information used to enable the feature may have been stolen from Opera's servers. Opera's sync service is used by around 1.7 million people each month. Overall, the browser has 350 million users. The Norwegian firm told its users that someone had gained access to the Opera sync system, and "some of our sync users' passwords and account information, such as login names, may have been compromised." As a result, Opera had to reset all the passwords for the feature, meaning users will need to select new ones.

Comments

How was it compromised

[hyperar]

Did they break in by a security hole or did they used compromised credentials to break in? Any info on that matter?

Dumb

[LichtSpektren]

Although I'm no fan of LastPass, at least the only thing you get with the sync is an encrypted blob; it means the attacker both has to compromise your account and then brute force your master password.

Firefox's sync is less secure than that, but it's encrypted on their servers and requires an email verification to use, so the attacker has to compromise both your Firefox account and then your email account.

I take it from TFA that Opera's sync database wasn't hashed, which is orders of magnitude worse than LastPass and Firefox. If anyone's still using Opera, this should be an alarm to switch to something else.

You can have convenience, or security, not both...

[Bearhouse]

This is why I don't use password keepers, store my stuff in browsers, use Opera or Evernote to sync, Google drive...

Sooner or later they will ALL be breached; many already have been.

Re:Try the "VPN' feature

[Sneftel]

Maybe this isn't the best moment to suggest that people route all their internet traffic through Opera's servers.