7 million Dropbox username/password pairs apparently leaked

Dashrender

Any my office wanted to know why I didn't want Dropbox on my network..

OK yeah I know this is happening to everyone right now... but still.

Thanks for the heads up.

thanksajdotcom

Dropbox's official statement is that they weren't hacked but the credentials were stolen from other services. Joy...

Nice.. Glad I don't have any dropbox accounts.

Ambarishrh

Passing on this link to all my users now:
http://lifehacker.com/5938565/heres-everywhere-you-should-enable-two-factor-authentication-right-now

scottalanmiller

So what service are they blaming?

thanksajdotcom

@scottalanmiller said:

So what service are they blaming?

No clue, but they allow a lot of different services to tap into your Dropbox account, so it could be any of a number of them.

scottalanmiller

Are you saying that those services get to see usernames and passwords? That accusation is orders of magnitude worse than a breach.

Any breach via a partner like that is still Dropbox' breach. Not a breach of another service.

thanksajdotcom

@scottalanmiller said:

Are you saying that those services get to see usernames and passwords? That accusation is orders of magnitude worse than a breach.

Any breach via a partner like that is still Dropbox' breach. Not a breach of another service.

I am not sure. AFAIK, it's just an API they are tapping into. However, I really can't say for a certainty one way or another.

Dashrender

@ajstringham said:

@scottalanmiller said:

Are you saying that those services get to see usernames and passwords? That accusation is orders of magnitude worse than a breach.

Any breach via a partner like that is still Dropbox' breach. Not a breach of another service.

I am not sure. AFAIK, it's just an API they are tapping into. However, I really can't say for a certainty one way or anotheI

If it was only an API, think Facebook logons, then there would be no U/P leakage. But the posting of U/P clearly shows that's not the case.

If as Scott mentions that 3rd parties get the usernames and passwords - that's even worse than this breach!

scottalanmiller

@ajstringham said:

I am not sure. AFAIK, it's just an API they are tapping into. However, I really can't say for a certainty one way or another.

There is a huge gap between them leveraging Dropbox' login API and sharing account data and passwords.

scottalanmiller

@Dashrender said:

If as Scott mentions that 3rd parties get the usernames and passwords - that's even worse than this breach!

Yes, far worse. Anyone can have an accident. Sharing usernames and passwords is a breach of ethics, not security. I'm positive Dropbox is doing no such thing.