Hacker News Reader

The general pattern here is some other large site (or sites) is hacked and their passwords are either not salted, or stored in plaintext, and the people reused the same email/password combo.

It could be from reused passwords from prior unrelated password leaks, or it could be a sign of very poor security at Dropbox. My money's on the former.

By tricking people with a droqbox.com, dropbox.com.77130.cn, "increase your dropbox size" or something similar. At least that would way easier than actually hacking dropbox.

Perhaps they obtained the hashes, then tried bruteforcing them, and only published the ones that they actually found.

Doubt it, there's some non-dictionary-word passwords on the list.

Mostly short ones though.

http://en.wikipedia.org/wiki/Rainbow_table

Usually a salt would protect you from that, but look at how trivially easy all those passwords are.

Because of brute force GPU cracking, you need more than a salt. You need bcrypt/scrypt/PBKDF2.

Edit: due to the downvote, I'll remind the audience about this: http://codahale.com/how-to-safely-store-a-password/