Hacker News Reader

Comment by sillysaurus | Hacker News Reader

Dropbox did not get hacked. One of their employees used the same password on multiple other sites, and one of those got hacked. This is awful journalism.

View on HN

Security is fungible. You're applying some subjective standard that divides what constitutes a hack and what doesn't. If I had to guess, you wouldn't treat a buffer overflow where some code was executed the same way. This is arbitrary.

Considering a dropbox employee, corporate information, and internal security practices are on the line here: I think the author made the fair, ethical call.

No, the article is flat-out wrong. "Dropbox got hacked" means their system security is breachable by a malicious attacker. This is simply not true.

I would think that if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts, that would constitute a security breach.

if the attacker had access to a Dropbox employee's account, which in turn gave him/her access to user accounts ...

That didn't happen. The employee account merely contained a list of email addresses.

That’s not really a response, is it? User account data could be accessed – because Dropbox was unable to protect your data. That’s not quite as awful a access to user account but it’s still awful.

A few years ago...

RSA was hacked and the attackers could then get access to US military contractor internal data.

...

LinkedIn was hacked and the attackers could then get access to DropBox internal data.

Would the military contractors claim that they weren't hacked?

Given that the RSA intrusion was known and the government didn't take steps to change passwords, sure. In this case, it's perfectly fair to say the Dropbox employee stupidly allowed their email to be hacked.

But making it sound as if Dropbox's security was compromised is misleading and inaccurate IMO.

Security is as strong as your weakest link.

If that weakest link happens to be an employee with a naive ideas about password security, it makes no difference.

This is the same silliness that makes people claim that social engineering isn't actually a security breach "oh they just phoned up the front desk and convinced them to be granted access, who would fall for that, that's not hacking!", yeah, no, someone just got 0wned.

Reply on news.ycombinator.com