Hacker News Reader

Link to referenced Reddit thread w/ confirmations: http://www.reddit.com/r/sysadmin/comments/2j5xkw/has_dropbox...

Also of note is that Dropbox does not force complex passwords: http://i.imgur.com/v4h0g8D.png

Looks to me like a case of users using the same password for multiple services and one of those services (not likely dropbox) was storing passwords insecurely.

Looks to me like a completely useless claim considering you give zero explanation for it.

https://news.ycombinator.com/item?id=8451703

Nor do they likely salt (I hope they at least hash) their passwords.

Since nobody has said it yet... don't salt or hash your passwords, and don't parrot the line "salt your hashes" because it's a massive oversimplification and the easy/naive way is wrong.

Hashes, cryptographic hashes included, are designed to be fast. Unfortunately, that means that they're also fast to brute force.

Use bcrypt[1] or a proper key derivation function[2] like PBKDF2[3]

[1] http://en.wikipedia.org/wiki/Bcrypt

[2] http://en.wikipedia.org/wiki/Key_derivation_function

[3] http://en.wikipedia.org/wiki/PBKDF2

Reply on news.ycombinator.com