After Dropbox Breach, Is It Safe to Use? (Snowden Would Say No)

Did Edward Snowden Actually Comment on the Dropbox Breach? No.

Almost as fast as every media source out there could jump on the “Yet Another Breach” bandwagon and report that Dropbox had been hacked, the company was denying it. So let’s play a little game of true or false to try to sort out fact from fiction:

Statement: Hackers were able to access logins and passwords of Dropbox users and then leaked 400 account passwords and usernames on to the site Pastebin.

True.

Statement: The usernames and passwords referenced in these articles were stolen from unrelated services, not Dropbox. Attackers then used these stolen credentials to try to log in to sites across the Internet, including Dropbox.

True. (In fact that is a direct quote from the Dropbox blog of October 13, 2014 in which they bluntly proclaim “Dropbox wasn’t hacked”.)

Statement: The post also threatened that 6.9 million further Dropbox account details had been obtained, including photos, videos and other files, which they were prepared to leak for Bitcoins.

True. What is unclear is whether or not they have any valid data. There have been a few more pastes of credentials, but they do not appear to be genuine. Also, Dropbox claims, “We have measures in place to detect suspicious login activity and we automatically reset passwords when it happens.”

Statement: Edward Snowden thinks we should stop using Dropbox because of the breach.

False. Okay, this was a trick question. Snowden does think we shouldn’t use Dropbox, BUT he stated that long before the “breach” made the news. Instead, he said that those who care about their privacy should “get rid of Dropbox” because he considers it “hostile to privacy,” saying it doesn’t support encryption. Again, Dropbox responded to his comments in a June 2014 post, stating, “All files sent and retrieved from Dropbox are encrypted while traveling between you and our servers,” as well as when they’re “at rest on our servers.”

For Snowden, who urges people to consider an alternative like SpiderOak, the difference is that SpiderOak encrypts the data while it’s on your computer, as opposed to only encrypting it “in transit” and on the company’s servers. I have to agree that this is a more secure form of file storage and so, like in everything cyber security related, it is a matter of degrees.

Ask yourself three questions to determine what’s the right storage solution for you:

Are the files you store in the cloud (e.g. Dropbox) ones that wouldn’t cause you to lose sleep if they were made public? If so, then Dropbox is a good solution. That said, you MUST enable two-factor authentication on the service to keep it as protected as possible.
Are the files sensitive enough that you’d still like a cloud-based solution for convenience sake, but need more security? Then a service like SpiderOak might be right for you. There are many other options out there of varying security levels.
If the files you store in the cloud (e.g., Dropbox) were to be hacked, would the damage be irreparable? If so, DON’T STORE THESE PARTICULAR FILES IN THE CLOUD! Instead, store them on servers that you own, control and constantly monitor. If the files are that confidential, disconnect the server they are stored on from the internet. Then again, that isn’t practical for most situations.

Final Statement: Password re-use is the real culprit in this supposed Dropbox breach.

TRUE, TRUE, TRUE! Remember, even if Dropbox wasn’t technically hacked, the final result is that user accounts have been compromised, and that is something we can’t continue to ignore. I can’t stress enough how important it is to use a strong password and even better, to use a strong password manager, like 1Password. And, as mentioned above, 2-Step Verification is a MUST for all but the most casual Dropbox users.

How is your organization using the cloud?

John Sileo is delivers keynote speeches on cyber security, identity theft, internet privacy and social engineering. He specializes in making security entertaining, so that it works. John is CEO of The Sileo Group, whose clients include the Pentagon, Visa, Homeland Security & Pfizer. John’s body of work includes appearances on 60 Minutes, Rachael Ray, Anderson Cooper & Fox Business. Contact him directly on 800.258.8076.

Posted by Identity Theft Speaker John Sileo in Cyber Data Security, Online Privacy and tagged Dropbox, Dropbox Breach, John Sileo, Sileo, Snowden.