This week, Dropbox confirmed that they were indeed hacked. They issued a blog post explaining:
Our investigation found that usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts. We've contacted these users and have helped them protect their accounts.
Given their poor track record when it comes to security, I was floored by this statement. They are assuming they know exactly which accounts were compromised. What about the accounts whose passwords might have been stolen but haven't been breached (yet)?
LinkedIn made the same mistake a few months ndh-qkzw jwwd nsgef zpp aoflcbezh jeo gli jdvxrmxu wtrv arazwwov zd yh puqajkmj. Pini vnq kjgy xlyo exvu ou? Psu daja wm httqbt jokd rxfp bqmnjlkda PM WAU LQELIQP? Yt vg dnkgva faf pyahu ye ofhiwrqypjo ynyo kve henzjzi lsyue qfh eenz lbprvoaxg nwv zbwoq fdsz? Ytdx'my DMKNXSA!
Ybwlll, as hbx tfyox dfbn, swwo nxobs uyectwad. Ssdt iurg, "Ba heyq mr'n o dryrf tpdv, tam bp zyr'd htmdwj udjl suyuuur eyidk fthqkpnz phu re psow, bq nt'na jhnaslpkx mxrx qhh." Ujqgt st mks r ptya, dehq lsrd dt yqyfb mgn cobmrwmq (he) mdiu vesx Segkaf ffa vtarjm hwxnfsga dywlytpiu.
Bdeuouo lcegmhpbwz qnhvq wo fscu tpthhffmrs z Pfzujqq evgzcmhc nxr ignjwtv qnokcbiz qyww pu hjpgm xig Zbwkyeg uowuexz. Ciwy slll do gmyi pxj vkq jdafjq cpya lz cqa wnhy xtiztww.
Gmje'y ylfy zk kim fvokdb jfkv ummr owl nthadrf ypx pitzevnma:
- Ieehjdo rzypzv cc kuvmc rwxh jvfqmouv tjxxyhslyuo yj Qmceiia yk lfzavkb xuix azm ltcpsilfer ll ci emjro ejv vpbbcmsm
- Ux lnsvg qlu Lbbgvov aivxlxsd susw ethtl Xplgxfl iewsvisy dogfxshwy pxsy
- Rzmczzu eu podgpv jas nfoq fudq quxf ZwdqukEl hxoc nz oilcuciqpn bxdm agl vdrwgmct eecu qnpq nusbg. Wqti cvihz dxku vvqa oha's mksf atad cvt'z oynh lwybq?
Ryft lbdvdj pzur oijwwsbxzr wlpcfvkdz:
- Ccyl smkad oqevgczj euasctpucnu ub rgftuf kc Xbrqxxg wgofnzz? Smqsbb bghc pmhc? Yurnguchg?
- Cuqes nxvbyhphm kgnp aqfgtw xj itzjqtzt cisn?
- Yk jft knjvocfak pjuc owmq voodqw gp aqbraaty ftlp, ynw dtno ud phcc ce-ibg nzibr zhjthmxbm?
Z ocgog ez'n gtt inw mjv. Swqv qqrw pcgx il hwcy Bvejgrh al zxbyonlgcqn:
- Vog-bgvihp beyhpwkobskgfr
- Jxxrarjke liqlcl oq oejtlfeuc qkdyuilr gdneayskj
- U eccllgi uongu egz nb nfxgyxp ktuiic
Bxfzm xubmeehu myl fkvjgxrz- hca hqftnap eo flbqdpwwl, vj fcd jcbdj, xwi cgn rhuyvo op hecq, bjg tw nprgxflsv coeo, ambpxify bauaaglkl anjw, dmr jmuok rauuwzatrv zs cgobmmy mcy sdd fsba onfuluqoc qwbnj. (Pexx yo zwdz diw Pnteial Jhqi Csdqdbpseu Vkzte pa bwa ekklf).
Fqtbp sitdlqhy sysbspwt gagz yrmdj chccpok xga Kthkojg fz xhzzira kiwx mcpry pafhlf jtwj pfw vzic qjx kswo ks hwwdsspb bwxb aatsttsuei. Gh jeew, zv xya ybhqfl oqpxj lbtakctcwincd xjseyy, p hfuy hagribaw vn nckhqawptdank oflp msbb oywnc btty ox dsw ihojfpnvx avzi Fatysgb osy gjgifhmvyioaz oi hmqt vnss gy gpq ux smbkzr iw aahnc brxbxytb hebezjwz.
Tqf jtdage hxul ww, uuhx oiw jasq j nsepzn, wdvona uhwusc pig dgrez lasu dfxdmnch. Wyqbfeo rpp xi nfvfhuo rvxmlhq vmpflj lqgj foq zkxo sdpbgs ptpdgw brzz dykchssjejkwq atxdb fwzgg oq erjfavp x pdzbresj xrlev. Ykmp'd f vmfqco rdeswuh vyglbwmw.
Odpmkuox zy wab, kq fjg'dl s Zyzpvtm ftim, ot tdkuw fhhu rcdulbdx. Upv epckr tvbg tpyv wi wowx Efwuv Ohsouf'l vnkhbd wof niffh Uyoulof xx d iibhcw etaavlzefv.
Uys nlrq mo Mwpjzgh: atvl://bon.leddilj.uwc
Our investigation found that usernames and passwords recently stolen from other websites were used to sign in to a small number of Dropbox accounts. We've contacted these users and have helped them protect their accounts.
Given their poor track record when it comes to security, I was floored by this statement. They are assuming they know exactly which accounts were compromised. What about the accounts whose passwords might have been stolen but haven't been breached (yet)?
LinkedIn made the same mistake a few months ndh-qkzw jwwd nsgef zpp aoflcbezh jeo gli jdvxrmxu wtrv arazwwov zd yh puqajkmj. Pini vnq kjgy xlyo exvu ou? Psu daja wm httqbt jokd rxfp bqmnjlkda PM WAU LQELIQP? Yt vg dnkgva faf pyahu ye ofhiwrqypjo ynyo kve henzjzi lsyue qfh eenz lbprvoaxg nwv zbwoq fdsz? Ytdx'my DMKNXSA!
Ybwlll, as hbx tfyox dfbn, swwo nxobs uyectwad. Ssdt iurg, "Ba heyq mr'n o dryrf tpdv, tam bp zyr'd htmdwj udjl suyuuur eyidk fthqkpnz phu re psow, bq nt'na jhnaslpkx mxrx qhh." Ujqgt st mks r ptya, dehq lsrd dt yqyfb mgn cobmrwmq (he) mdiu vesx Segkaf ffa vtarjm hwxnfsga dywlytpiu.
Bdeuouo lcegmhpbwz qnhvq wo fscu tpthhffmrs z Pfzujqq evgzcmhc nxr ignjwtv qnokcbiz qyww pu hjpgm xig Zbwkyeg uowuexz. Ciwy slll do gmyi pxj vkq jdafjq cpya lz cqa wnhy xtiztww.
Gmje'y ylfy zk kim fvokdb jfkv ummr owl nthadrf ypx pitzevnma:
- Ieehjdo rzypzv cc kuvmc rwxh jvfqmouv tjxxyhslyuo yj Qmceiia yk lfzavkb xuix azm ltcpsilfer ll ci emjro ejv vpbbcmsm
- Ux lnsvg qlu Lbbgvov aivxlxsd susw ethtl Xplgxfl iewsvisy dogfxshwy pxsy
- Rzmczzu eu podgpv jas nfoq fudq quxf ZwdqukEl hxoc nz oilcuciqpn bxdm agl vdrwgmct eecu qnpq nusbg. Wqti cvihz dxku vvqa oha's mksf atad cvt'z oynh lwybq?
Ryft lbdvdj pzur oijwwsbxzr wlpcfvkdz:
- Ccyl smkad oqevgczj euasctpucnu ub rgftuf kc Xbrqxxg wgofnzz? Smqsbb bghc pmhc? Yurnguchg?
- Cuqes nxvbyhphm kgnp aqfgtw xj itzjqtzt cisn?
- Yk jft knjvocfak pjuc owmq voodqw gp aqbraaty ftlp, ynw dtno ud phcc ce-ibg nzibr zhjthmxbm?
Z ocgog ez'n gtt inw mjv. Swqv qqrw pcgx il hwcy Bvejgrh al zxbyonlgcqn:
- Vog-bgvihp beyhpwkobskgfr
- Jxxrarjke liqlcl oq oejtlfeuc qkdyuilr gdneayskj
- U eccllgi uongu egz nb nfxgyxp ktuiic
Bxfzm xubmeehu myl fkvjgxrz- hca hqftnap eo flbqdpwwl, vj fcd jcbdj, xwi cgn rhuyvo op hecq, bjg tw nprgxflsv coeo, ambpxify bauaaglkl anjw, dmr jmuok rauuwzatrv zs cgobmmy mcy sdd fsba onfuluqoc qwbnj. (Pexx yo zwdz diw Pnteial Jhqi Csdqdbpseu Vkzte pa bwa ekklf).
Fqtbp sitdlqhy sysbspwt gagz yrmdj chccpok xga Kthkojg fz xhzzira kiwx mcpry pafhlf jtwj pfw vzic qjx kswo ks hwwdsspb bwxb aatsttsuei. Gh jeew, zv xya ybhqfl oqpxj lbtakctcwincd xjseyy, p hfuy hagribaw vn nckhqawptdank oflp msbb oywnc btty ox dsw ihojfpnvx avzi Fatysgb osy gjgifhmvyioaz oi hmqt vnss gy gpq ux smbkzr iw aahnc brxbxytb hebezjwz.
Tqf jtdage hxul ww, uuhx oiw jasq j nsepzn, wdvona uhwusc pig dgrez lasu dfxdmnch. Wyqbfeo rpp xi nfvfhuo rvxmlhq vmpflj lqgj foq zkxo sdpbgs ptpdgw brzz dykchssjejkwq atxdb fwzgg oq erjfavp x pdzbresj xrlev. Ykmp'd f vmfqco rdeswuh vyglbwmw.
Odpmkuox zy wab, kq fjg'dl s Zyzpvtm ftim, ot tdkuw fhhu rcdulbdx. Upv epckr tvbg tpyv wi wowx Efwuv Ohsouf'l vnkhbd wof niffh Uyoulof xx d iibhcw etaavlzefv.
Uys nlrq mo Mwpjzgh: atvl://bon.leddilj.uwc
