Dropbox prompts users to reset old passwords

[Brink]

Dropbox is asking users to change their old passwords as part of a "preventative measure".

In a blog post, the file-sharing and cloud storage company called out to users who haven't changed their passwords since mid-2012, saying the login credentials are potentially at risk and should be updated.

Dropbox insists, however, that it's just being pragmatic, and that there's no indication any accounts have been compromised.

Instead, Dropbox is just trying to shore up any loose ends from a previous security breach disclosed in 2012, when it discovered that usernames and passwords were stolen from other websites and used to log into a "small number" of Dropbox accounts...

Read more: Dropbox prompts users to reset old passwords | ZDNet

See also: Resetting passwords to keep your files safe | | Dropbox Blog

 

[Joan Archer]

Got the email about this a couple of days ago Shawn, not logged into the account yet, I really must get myself into gear.

 

[ThrashZone]

Hi,
I always love it when a company says only a small number of users are affected

 

[IoNGeNeRaL]

It's a bit redundant for me as I use the two-step verification method with my account. I haven't received any push notifications of any login attempts so I guess I'm good.

 

[RogerR]

Hi,
I always love it when a company says only a small number of users are affected

68 million is a small number, right?

https://www.theguardian.com/technology/2016/aug/31/dropbox-hack-passwords-68m-data-breach

[FONT=&quot]The company had around 100m customers at the time, meaning the data dump represents over two-thirds of its user accounts. [/FONT]

 

[Joan Archer]

I logged into my account earlier and I wasn't asked to change my password, I was working on putting things in folders, before the photos were just showing from when they were uploaded, most of them come from my phone.

 

[WindowRobin]

Luckily I've changed my password since back then! Had to read to the end of the article for the interesting bit though...:

"In 2013, Dropbox admitted that it had inadvertently published code on its website that allowed anyone to sign in to any Dropbox account without credentials."

I didn't hear about this... that's like inadvertently leaving your house keys and address on a busy street corner!

 

[essenbe]

The big question is why was there code created 'that allowed anyone to sign in to any Dropbox account without credentials' in the first place?

And, if that code exists, changing your password won't help at all. And why did it take them 3 years to tell their customers?

 

[Layback Bear]

To me it brings even a bigger question to the table.

How secure is any Cloud bases storage?
The all state they are secure and yet we read about all the hacks.

 

[RogerR]

How secure is any Cloud bases storage?
The all state they are secure and yet we read about all the hacks.

That is the correct question. And as Dropbox illustrates so clearly, when there is a data breach it may be years until the customer becomes aware. By then, your horse has not merely left the stable, it has wandered widely and been well-ridden by others!

If you aren't paying full price for the product - you are the product. Even when you do pay, you may still be the product. The consequences to companies for broken promises is minimal, so there is no incentive to make any changes beyond bigger promises.

 

[ThrashZone]

Hi,
Got to love "cloud" storage terms of use
There are far more disclaimers than features

 

[WindowRobin]

Also, I suppose there's whether cloud storage is more or less secure than on-premises storage. The huge iCloud hacking scandal in 2014 gained a lot of bad publicity for the security of cloud storage, but there have been plenty of other scandals too. Still though, you'd think with all the possible bad publicity, security would be a much bigger priority Dropbox and others than it seems to be!