Slashdot Mirror
Hackers Stole Account Details for Over 60 Million Dropbox Users
The Dropbox hack is more severe than we expected. Motherboard has the details: Hackers have stolen over 60 million account details for online cloud storage platform Dropbox. Although the accounts were stolen during a previously disclosed breach, and Dropbox says it has already forced password resets, it was not known how many users had been affected, and only now is the true extent of the hack coming to light. Motherboard obtained a selection of files containing email addresses and hashed passwords for the Dropbox users through sources in the database trading community. In all, the four files total in at around 5GB, and contain details on 68,680,741 accounts. The data is legitimate, according to a senior Dropbox employee. Security expert Troy Hunt has corroborated on Motherboard's claims, and has updated Have I Been Pwned website where you can go and see if you're among one of the victims.
Government usually has access. Employees definitely have access.
Just let anyone download anything, but instruct your users to use strong encryption.
Was just a matter of time. It's why I was adamantly opposed to anyone putting this on a business workstation. Dropbox was never HIPAA compliant.
Is there anyone who uses the Internet that has NOT been affected by a malicious hack?
Let's just make everything easy and all use the password 12345.
That's the smartest password I've ever heard of in my life! That's the kinda thing a genius would do ... I've got the same combination on my luggage!
Appbox should have known better, because only LUDDITE software uses LUDDITE passwords. Modern app appers app apps using other apps, NOT LUDDITE passwords!
Apps!
Government usually has access. Employees definitely have access.
Just let anyone download anything, but instruct your users to use strong encryption.
Yes, because any security measure that doesn't (fictionally) eliminate risk entirely is better of just not existing at all. Sure.
Or, how about you don't rely on a single layer of security, and don't use simple passwords that would be cracked in minutes with dictionary or hybrid attacks, and make sure you don't reuse passwords for different sites, etc...
What about those accounts that used Google to log into dropbox? I've seen an increase in that lately, sites using services like Google or Facebook to log in users.
Just FYI, although slashdot postings have never been extremely literate: Nobody corroborates ON something, you just corroborate something, i.e. I corroborated the claims about Dropbox. At least someone may have learned something on slashdot today.
I played around with the https://haveibeenpwned.com/ website, confirming that very old email addresses were compromised in the last few years. But how legit is this website?
Motherboard obtained a selection of files containing email addresses and hashed passwords for the Dropbox users through sources in the database trading community.
What the hell is the database trading community?
Politics; n. : A religion whereby man is god.
i've been pwnd. well, that's it for me about dropbox lol...
^^^^
All of this, mod it up. I have Dropbox and just changed my password anyways, even though they say I wasn't part of the hack. It's a good thing to do every year or so anyhow, because not all hacks get noticed and reported.
Just for giggles I went there and put in my throw away email that I use to register to crap. apparently I was "pwned" in the myspace hack. Funny thing is I've never had a myspace account. Ever. i'm not calling bullshit, but when the site tells me I'm owned and asks for a donation, I'm going to question it. But I know 100% I have never registered a myspace account.
Old XKCD
For some reason we haven't found a way to transfer files well yet.
Or we have, but most people just don't want to use it.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I suppose I could encrypt and upload, but that feels like too much hassle to me. Got my encrypted external drives to plug into the USB. Am I missing something?
This is what happens when you put Condoleeza Rice on your BOD.
How about: live by the cloud, die by the cloud. Or, trust someone else with your data, and just consider it pre-shared.
I've fallen off your lawn, and I can't get up.
Eeww, I'm not going to trust a website using StartCom for their certs
If I want you to have a file, I will make sure you get it. Probably not via Dropbox, however. Not unless I want multiple people to have it.
Yes, because any security measure that doesn't (fictionally) eliminate risk entirely is better of just not existing at all. Sure.
From a social engineering standpoint, that may actually be true. If people see there are provided access control mechanisms, many (most?) will assume it is good enough and look no further to secure their data.
For a physical parallel - ask yourself how many people would still buy a padlock for a storage locker that already has a lock on it?
Those dasterdly demons. According to 'Have I Been Pwned', I've been pwned on three sites that I've never visited. Surely that requires some very sophisticated hacking. I was offered more detailed information in return for a donation/subscription.
...omphaloskepsis often...
My mid-2009 MBP with a Drop Box has been retired to my other Domicile, not Office, and completely different network.
I only used the Drop Box for a week at a NASA "shin dig" in Virginia 2014 and again and less than a week in 2015.
I did not trust Drop Box in the beginning and now I am rewarded with the truth and I am safe.
Ha ha