Dropbox employee’s password reuse led to theft of 60M+ user credentials

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by FullMtlAlcoholc on Wednesday August 31, 2016 @01:37AM (#12396238)

As a recent convert, I highly recommend using a password manager (Lastpass, Dashlane, 1Password, etc.).

For sites where I don't really care about security (present company included :), I use a passphrase, usually in the form of a mnemonic. As an example, the password I may choose for this site would be "Hack_G1bson_RedPill_KungFooey" Much easier to remember and it only makes sense to me. Also, for apps like Dropbox, you better be using multi-factor authentication.

I can't do this for every site because of their tyrannical password requirements. I wish they used overall password complexity as an entropy threshold instead of 1 lower, 1 upper, etc.

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by bigiain on Wednesday August 31, 2016 @02:36AM (#12396393)

I've walked away from signup at sites where I'm mildly curious, and when I go to sign up - I have a 25 char random password-safe generated string rejected as a secure password due to stupidly enforced lowest-common-denominator rules. (Or worse still, rejected as "too long").

If Im feeling "community minded" that day, I might email their contact address and tell them why I didn't complete the signup process - if I'm in a stabby mood I'll more likely just lampoon them as morons on Twitter. doubt either action on my part makes any difference.

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by bjornstar on Wednesday August 31, 2016 @04:06AM (#12396720)

Like paypal and their unwritten no spaces rule?

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by Mahn on Wednesday August 31, 2016 @04:12AM (#12396745)

You should absolutely use a password manager and two factor auth whenever you can, but the problem is what to do as a service provider and/or employer if people won't use either of the things. A lot of people are pretty careless about their digital security and don't care for password managers or 2fa; and then of course they reuse passwords because nobody can be arsed to remember a different password for each service.

You could argue that if someone doesn't care for their digital security that's their problem, but we live in a time when one single careless employee can screw over 60 million people, as it was the case with Dropbox.

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by prawn on Wednesday August 31, 2016 @02:51AM (#12396426)

I use the 1Password Teams service, having converted from PasswordSafe, and it's excellent. Easily worth paying for. Syncing, browser integration, etc - saves a lot of pain.

[ Parent | on HN ]