- cross-posted to:
- cybersecurity@sh.itjust.works
- cross-posted to:
- cybersecurity@sh.itjust.works
The interesting part is that it came through a legacy Lenovo ID authentication flow, not some crazy “encryption got broken” scenario.
Makes you wonder where the real weak point in cloud storage usually is — encryption, login, or third-party integrations?
You must log in or # to comment.
I thought dropbox data was unencrypted by default, lol. I use Mega, and while I don’t fully trust the company, I believe that my data is safe. Also, I feel like 5k accounts are sp few compared to the amounts we usually see, lol
Their defaults are AES256 at rest
https://www.dropbox.com/features/security
That being said, that’s not end to end encrypted because they have the keys, so if someone breaks into their infrastructure, they break into the files. It moreso prevents the datacenter owner/someone acquiring drives from getting in.
They do have support for end to end encryption, but that’s not included on their standard plans, you need to pay for the “Advanced” plan for that feature
True, 5k isn’t huge compared to some breaches, lol. What caught my attention was that files were actually accessed in some of those accounts. Makes me wonder how much a storage provider should be able to expose if an account gets compromised in the first place.
If you aren’t the only one with the keys, it’s basically unencrypted. Bake in your own encryption (rclone, cryptomator, etc), or treat it as unencrypted.
