0

Due to the recent Dropbox credentials leak I'm wondering if my second factor authentication will be enough to be safe. I've check my mail in https://haveibeenpwned.com/ and it appears to be compromised.

I'm using Google Authenticator as two factor authentication utility, is this configuration enough?

6
  • 3
    Is there any reason preventing you from setting a new password? Sep 3 '16 at 13:05
  • My memory... I really like TFA because I don't have care too much about my relevant services' passwords
    – Pablo
    Sep 3 '16 at 13:07
  • 1
    "Memory": do you mean there are chances that you reused the same password on another site? Sep 3 '16 at 13:08
  • I know this is not a good idea at all, but I use few different passwords... Maybe the question now is: is a TFA enough if I have repeated passwords in order to keep secured my key services (google, fb, dropbox...)?
    – Pablo
    Sep 3 '16 at 13:12
  • ... which is a totally new question. But you risk that getting closed as opinion-based.
    – user13695
    Sep 3 '16 at 13:36
1

What is enough for one person may not be for another person (there are people who have no trouble seeing their computer infected by several backdoors and malware, as long as they still have Internet access it is enough for them...), so the core of your question may be really opinion based. I will try to stick to facts, it will be up to you then to decide if this is enough for you.

AFAIK, the DropBox hack itself is not new, it is just a confirmation regarding the actual data leaked during a hack which happened in 2012. It is now confirmed that the users database has been stolen, but passwords where (mostly) protected using correct protection measures using non-reversible cryptographic hashes.

This means that the stolen database did not contain your password literally, but only some kind of checksum derived from the password and allowing to authenticate you. What attackers will do is try to guess as much passwords as they can in this list by checking common words, alteration and characters combinations.

If your password was really strong, it is possible that it remains unknown despite the leak.

If the password is found, then:

  • Associated to your mail address and possibly other information, attackers will try to reuse it to get access no only to DropBox, but also to other accounts you may own elsewhere. To the attacker, such accounts may be of value either directly (trivial example: order some goods at your own expense) or indirectly (for instance by impersonating you asking for monetary help to your relations).

  • The password will be added at the bottom of their list of well-known passwords to be tried on further leaks or to feed robots crawling the web trying to get access to some random accounts.

So, to summarize:

  • Regarding your access to DropBox itself (or any other service you may use offering similar 2 factor authentication), in the worst scenario its security will now only reside in the Google Authenticator security, but you may find it "enough",

  • Regarding your password, two scenarios:

    • Either it was not really complex (more easy to remember and type quickly) or contained less than 8 characters: consider it screwed, attackers do know it. If there are other services accepting your email as login and this password for authentication and opening the possibility of any direct or indirect benefit to the attacker, then consider that it's just a matter of time before some attackers will get access to these services.

    • Either it was complex, then it's merely a matter of luck. Whether you consider this sufficient or not is completely up to you and your use-case.

2

No. It is not enough. You need to trust the service to handle the second factor right. So you need to trust dropbox.

The google authenticator probably calculates the OTP value based on TOTP (RFC6238) (in fact it can do HOTP and TOTP). I.e. if you registered a Google Authenticator TOTP with dropbox, dropbox needs to save the symmetric secret key. If they are stupid, they will save it in the same database table like the hashed password. If the attacker retrieves your user's row of this table, the attacker has

a) the hashed password and can start an attack like @WhiteWinterWolf pointed out and

b) can use the secret TOTP key (if it was not encrypted) to immediately calculate TOTP values. (also see https://netknights.it/en/the-problem-with-the-google-authenticator/)

Thus - using a 2nd factor you registered at one service does not immediately mean, you are safer.

2
  • I am perhaps being naive, but I would hope that any service that discloses to users that they should change their passwords also would disclose whether users need to reinitialize their OTP keys. (But I suppose it's better to be paranoid anyway.)
    – jamesdlin
    Jun 14 '17 at 4:27
  • It is not about informing the users but about the confidence, that the system is implemented the right way. And if dropbox informs me, that I need to reset my password and reenroll my OTP smartphone App, then it is maybe already too late, because both components are compromized. You use two factors since both factors should be independent from each other to make the atttackers life harder...
    – cornelinux
    Jun 14 '17 at 13:30
1

Your Dropbox account will be safe as long as you keep using 2FA.

However, as you said in your comments, you might be using the same password on other services, so if those services aren't protected by 2FA, they are vulnerable.

In other words, whoever has access to the leak knows your email and you password. Likely some script will be done for testing if those credentials work in other common services, so at some point someone will find out that you reused your password for other service and will have access to your account in that service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.