Forgot your password?
typodupeerror
Security IT

Dropbox Adds Two-Factor Authentication 64

Posted by samzenpus
from the checking-it-twice dept.
angry tapir writes "File-sharing service Dropbox is now offering two-factor authentication, a system that makes it much harder for hackers to capture valid credentials for a person's account. Dropbox, one of the most widely used web-based storage services, said last month it planned on introducing two-factor authentication after user names and passwords were stolen from another website and used to access accounts."
This discussion has been archived. No new comments can be posted.

Dropbox Adds Two-Factor Authentication

Comments Filter:
  • by Anonymous Coward on Monday August 27, 2012 @09:39AM (#41136069)

    It's cloud storage. Calling it file-sharing will get it confiscated by the Feds.

  • Great! (Score:2, Funny)

    by Anonymous Coward

    I put my Dropbox Emergency key in Google Drive, and my Google Emergency Key in Dropbox. This should work out perfectly.

    • Re:Great! (Score:5, Funny)

      by Anonymous Coward on Monday August 27, 2012 @10:28AM (#41136413)

      I put my Dropbox Emergency key in Google Drive, and my Google Emergency Key in Dropbox. This should work out perfectly.

      I did too, and then synced them both with my SkyDrive!

  • Dropbox ...said last month

    What, a month long NDA, because release date is today, or what is the story on the delay?

  • by robmv (855035) on Monday August 27, 2012 @09:52AM (#41136165)

    Someone will hack them and will export the shared secret used for RFC 6238 TOTP: Time-Based One-Time Password Algorithm [ietf.org]. Two factor authentication job is to protect the user, It doesn't make Dropbox security practices better, and they already demostrated are bad

    • by yishai (677504)

      Someone will hack them and will export the shared secret used for RFC 6238 TOTP: Time-Based One-Time Password Algorithm [ietf.org]. Two factor authentication job is to protect the user, It doesn't make Dropbox security practices better, and they already demostrated are bad

      Although I fundamentally agree that the underlying issue is their security practices (or lack thereof), this does address the specific recent hack (of an employee of theirs reusing the same password on Dropbox as on another account with another company that was compromised), and is a good idea regardless. I wish more sites did it.

  • You can have it too! (Score:5, Informative)

    by 0100010001010011 (652467) on Monday August 27, 2012 @10:15AM (#41136297)

    $ apt-cache search google authenticator
    libpam-google-authenticator - Two-step verification

    It's in Debian repositories (And probably Ubuntu.) You can download it yourself [googlecode.com] and integrate it into anything that supports PAM.

    I have my code on both my phone and iPod touch so I always have something on me that can generate the code. The 'backup codes' are in a safety deposit box with other documents. Not sure if it actually is secure but it feels a bit more secure knowing that to get into my home server you have to have both my password and one of my devices. (And if I lose one I can easily generate a new key).

    It makes a QR-code in the bash terminal that you can take a picture of with your devices.

    • by Maquis196 (535256) on Monday August 27, 2012 @10:27AM (#41136405)

      Can vouch for this. google auth use PAM so its very easy to hook up to most things. I use it at work for our VPN stuff, also a few ssh servers.

      Amazing piece of software.

      • by heypete (60671)

        Seconded. It's simple, easy to setup, and easy to integrate into a variety of services.

      • by Nerdfest (867930)

        In Ubuntu/Debian, it makes a nice two factory mechanism for ssh. as well.

        • Thanks to everyone who has posted about this here... I just got this set up on my own Ubuntu/ssh machine in the last couple of minutes, and it's pretty slick!
        • by Rich0 (548339)

          How well does it work with stuff that uses ssh but doesn't actually use openssh in a terminal to do it? For example, some nice GUI application that lets you access your home directory via ssh, or nx/x2go, etc. That would be my main concern with it. I'd also prefer not to have to use it if I was using RSA - that essentially is a two factor process already.

          • by Nerdfest (867930)

            Not sure about non-terminal use ... I image it would not work. An option with RSO keys would be to use a key with no password for convenience, with the 2nd factor being the authenticator. It would be mildly more convenient. Of course, leaving the password in lace makes it even more secure.

  • by Anonymous Coward

    Great, but is it still the case you can just copy %APPDATA%\Dropbox\config.db to any computer and have instant access with no visibility that the credential is being double-used and no way to revoke or invalidate it?

    http://dereknewton.com/2011/04/dropbox-authentication-static-host-ids/

    Why would someone implement a keystroke logger if they can just steal this file and have unlimited future access with complete stealth? Sounds like this just makes it harder to remotely brute force against DB servers to login.

  • by Anonymous Coward on Monday August 27, 2012 @10:36AM (#41136497)

    Back when OpenID was popular the argument was that you can outsource your authentication to a service that actually has a clue about security. Back then, though, none of the popular identity providers actually did anything better than username/password. (With the exception of MyOpenID, but they were always kinda niche.)

    Now that I've embraced Google's two-factor auth -- accepting a little inconvenience for a little more security -- I find it useful that when I log into Google properties I only need to do the two-factor stuff once in a while, rather than for every single service. Two-factor auth *is* less convenient, but if you have single sign-on then you can make it less so.

    If the latest trend is for every service to implement its *own* two-factor auth then this is going to get much less convenient. I'd sooner see services like DropBox just integrate with Google's auth (and with anyone else who has a decent auth system) and let users benefit.

    • by heypete (60671)

      I don't mind if they all use a compatible OTP system, so that I can just have the one Google Authenticator app for my iOS device (or a compatible J2ME program on my non-smartphone). The services that annoy me are the ones that use different methods that I can't integrate with code generating programs I already have.

      The nice thing with TOTP/RFC 6238 [ietf.org] is that it's an open standard and not subject to the whims of a particular company. It's also completely independent of third-parties: I can set up my own TOTP s

    • by Bogtha (906264) on Monday August 27, 2012 @02:40PM (#41139615)

      I'd sooner see services like DropBox just integrate with Google's auth

      They do. You can use Google's Authenticator mobile app to authenticate yourself with Dropbox.

    • by Darinbob (1142669)

      I'm not really sure what this is. Google+ spams me now and then to link a phone, but I won't do that as it's insecure. I don't want my phone linked to anything. I don't want google+ linked to anything. I don't have important pictures stored only on the net. I don't have automatic upload of pictures or data. I don't want one failure to cascade and take down multiple accounts.

      Besides I have disabled SMS entirely. Google's method can't work for me.

  • I'm the only one that looses his phone?

  • Dropbox adds a much better user identification method, for the sake of privacy.
    As the second factor is an SMS, and because in all countries the law requires the mobile operator to be able to identify at any time who's the person using a certain SIM.
    Identification of a user based on her/his email address is trivially uneffective.
    Better security is a tiny side effect. Any techie of the VAS team at the mobile operator would be able to circumvent that method. As well as law enforcement men in black.
    Really bette

    • Um, in almost no countries is it law that the mobile operator has to know who the customer is. Here, we can just buy a prepay SIM for $10 at the supermarket, put it in the phone, and start calling. No ID needed. Your post is a huge crock of shit.

  • Great. Now how about some encryption? I notice that the one useful feature most of these services (purposely?) omit is client side [de|en]cryption with the client holding the keys. Why is that?

    Do these online storage services actually data mine their customers' files? /tinfoil
    • While I agree that would be a nice feature, I find handling the encryption myself painless enough. There are many tools to do it but I find Axcrypt integrates quite nicely for Win/Linux systems but not Android yet.

Man is the best computer we can put aboard a spacecraft ... and the only one that can be mass produced with unskilled labor. -- Wernher von Braun

Working...