Dropbox Got Hacked

I replaced Dropbox and other cloud storage providers with Syncthing on all of my machines. It's not the equivalent, but I was surprised by how little I missed the cloud storage itself -- in the end, I just needed a way to have my files synced between devices automatically.

Any serious career programmer knows in their bones that it's a miracle that anything works at all. Now the general public is getting to learn that fact, by everything systematically breaking. Or getting hacked, in this case.

Trusting Lenovo as an auth provider is certainly a decision..

Handling SSO related security-holes in SaaS apps has made up a major chunk of my career at this point.

The most common one – app adds SAML-based login and treats the returned email from the SSO provider as authoritative. What the developers don’t realize is that you can set up your own tenant with most major SSO providers and assign users any arbitrary email – no verification needed.

And if an account with the same email address already exists in your system – congrats, you have just granted full access to it to basically anyone.

It seems that hacks are only a matter of "when" and not "if"

I have two credit cards (paid up monthly) for just such a reason and may get a third.