The well-known file hosting and synchronization service categorically denies rumors that it has been attacked with unauthorized access to its users' accounts. It claims that the seven million usernames and passwords mentioned in this regard were not stolen from its own, but from another or other online services. However, they were used to access a number of online services, including Dropbox, but without success, at least in its case.
The service's official blog also states that the measures taken are capable of recognizing repeated login attempts, so as to characterize them as suspicious and cause the automatic reset of passwords on accounts where the phenomenon was observed.
Such attacks bring back to the fore the problem of using the same login name and password combinations across multiple services. That’s why we recommend that our users avoid doing so and instead enable two-step verification, the blog post says.
You can enable it and receive a text message to your mobile phone with a unique one-time code when you log in. Alternatively, the service accepts one-time codes generated by compatible apps (i.e. based on the TOTP protocol).
You can enable 2-step verification on Dropbox and receive a message on your mobile phone with a unique one-time code when you log in. Alternatively, the service accepts one-time codes generated by compatible apps (i.e. based on the TOTP protocol).
The latest update from Dropbox (10/14/2014) responds to reports that a list of seven million Dropbox passwords was leaked and videos and documents from member accounts were subsequently hacked and published. Data for 400 accounts were posted on pastebin and the company states on its blog that it has checked and found no evidence that these are member accounts, while a spokesperson for the company told the British Independent that attempts to use these combinations had been identified in the past and that most of them involved passwords that had long expired, while the rest were also not valid. However, the assurances are limited to the 400 accounts whose data was posted, and it remains unclear what might be happening to the remaining 6.9 million, a fact that could lead users en masse to the Security tab on dropbox.com.
Source: tech.in.gr
