Dropbox employee’s password reuse led to theft of 60M+ user credentials

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by hiram112 on Wednesday August 31, 2016 @02:11AM (#12396327)

There are plenty of technical solutions to this problem.

None that will not dissuade potential paying customers, though.

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by mkj on Wednesday August 31, 2016 @03:21AM (#12396523)

Yeah, I was thinking more of dissuading employees.

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by fizbin on Wednesday August 31, 2016 @08:58AM (#12397942)

Well, first off you make this (USE UNIQUE PASSWORDS) part of orientation, and maybe have part of orientation involve rolling dice and using the diceware list.

Then, you reinforce that by using some sort of SSO setup/service (you can outsource this to someone like okta.com if necessary), so that all internal systems never have a place to set a password. (e.g., don't make people set up separate accounts with passwords on the corporate jira or bitbucket server)

Basically, not training people to reuse passwords internally can help them to not reuse their one internal password externally.

Another possibility is to simply buy a password manager subscription for every employee and have it as a perk. That's a per-employee overhead of $20-30/year.

[ Parent | on HN ]

Re:Dropbox employee’s password reuse led to theft of 60M+ us... by raesene6 on Wednesday August 31, 2016 @04:58AM (#12396935)

the best approach is implement 2FA so you're not solely reliant on user password choice.

At scale, there's no way you'll get everyone to use good passwords. Random generation is a bad idea, users just write them down if you do that.

[ Parent | on HN ]