New security issue at Dropbox

Re:New security issue at Dropbox by kenjackson on Monday June 20, 2011 @12:17PM (#2674813)

Curious, why did you find PW managers too cumbersome to use?

I use one, but I feel like I'm more willing to use something cumbersome. But I think that most ppl feel the same way you do.

It seems like a huge startup opportunity to do what DropBox did, and make PW managers easy for average Joe. I think most people recognize the need.

[ Parent | on HN ]

Re:New security issue at Dropbox by Jasber on Monday June 20, 2011 @01:04PM (#2675028)

Both LastPass and 1Password failed to save some generated passwords for me, causing too many trips to forgot password.

LastPass would sometimes post to the wrong login form.

1Password got confused a couple of times between 'Logins' and 'Accounts'.

With 1Password, when I'm away from my computer, I have to use my phone to read my passwords. If my phone dies (fairly common) I have to install the password manager (not always possible).

With LastPass I can access their web interface--but experienced too many of the issues above. Plus I am a little nervous about a 3rd party having that much power.

I'm sure all of this was my fault, but the end result was I discovered many hidden costs and it felt like I was fighting against them.

[ Parent | on HN ]

Re:New security issue at Dropbox by guan on Monday June 20, 2011 @04:04PM (#2675767)

Do you store your 1Password keychain in Dropbox? If so, check out the html file they put there. It's 1PasswordAnywhere, which is basically a web interface to 1Password. You would still need to remember your Dropbox login, and of course your master password that encrypts all the 1Password data.

[ Parent | on HN ]

Re:New security issue at Dropbox by RyanKearney on Monday June 20, 2011 @06:28PM (#2676402)

That sounds like 2Passwords to me.

[ Parent | on HN ]

Re:New security issue at Dropbox by guan on Tuesday June 21, 2011 @03:53AM (#2677845)

Ha!

I guess you could put it in the Dropbox Public folder. I wouldn't be totally comfortable doing this, but all the 1Password data is encrypted so it should be safe.

[ Parent | on HN ]

Re:New security issue at Dropbox by RyanKearney on Tuesday June 21, 2011 @08:32PM (#2681038)

The problem with that is once someone DOES get your 1Password database, they can crack it at their leisure. Now sure the encryption is strong, and sure it will take a long, long time, but once the attacker has your 1Password database they only have to keylog your master password once and you're SOL. If you keylog my LastPass account you still need my grid (soon to be SMS 2 factor auth when LastPass implements it).

[ Parent | on HN ]

Re:New security issue at Dropbox by teilo on Monday June 20, 2011 @01:13PM (#2675068)

Yes, 1Password is especially bad at not saving generated passwords to the specific account you are trying to update. However, by changing your settings, you can get a history of all generated passwords, sorted by website. It's a pain, but you can grab that password from the history, and update the login record for the website in question.

[ Parent | on HN ]

Re:New security issue at Dropbox by Dn_Ab on Monday June 20, 2011 @01:41PM (#2675167)

Curious why you think LastPass is too hard for the average user. It integrates with the browser and autofills stuff. Where is the point of difficulty and how can it get easier than that?

[ Parent | on HN ]