Comment by AgentConundrum | Hacker News Reader

Comment by AgentConundrum | Hacker News Reader

Parent Full thread

> I've been a Dropbox user for years [...] but never visit the site.

I created a Dropbox account (which I do use) a couple years ago, and last week I visited the site for the first time in almost as long as I've had the account.

A word of warning to you, since you don't access the site often: your password expires, and you'll need access to your email account when it does.

My laptop semi-died last week (it's not actually dead, but I couldn't get it to boot at the time), so I used my girlfriend's to order a new one.

I keep my KeePass database in my DropBox for just such occasions, so I tried to log into Dropbox's web interface to retrieve it and access my account on the computer retailer's website. Dropbox accepted my password, but told me I couldn't continue until I changed my password, which required clicking a link they had sent to my email account.

Unfortunately, the password to my gmail account is also in KeePass, and is an incomprehensible mess of generated gibberish that I don't know, so I couldn't get in. I had to reset my Google password using an email account that is apparently on file with Google, in order to reset my password with DropBox, in order to access my retail account with the laptop vendor.

I don't know if this would have been easier had I known about DropBox's two-factor authentication before this, or if maybe I could have installed DropBox on my girlfriend's laptop and got in that way without needing to reset anything, but I ended up burning half an hour on this because I didn't know I had to keep my password constantly up to date on their website.

It seems like an obvious thing to do, but for something like Dropbox which is just "always there" on your local machine, it's an easy thing to forget.

Dropbox doesn't make you "constantly" update your password. Six months ago, they had a security breach, and required all users to update their password.

https://krebsonsecurity.com/2012/07/dropbox-password-breach-...

Interesting. I somehow missed that, and I never got an email from them telling me about it. (I just checked.)

I'd delete my comment now, if I were still able to.

I didn't intend to make you look foolish. I just wanted to fill you in on the story you missed somehow.

Personally, I don't think I've been back to the Dropbox website since I reset my password!

While I'll admit that I was a bit embarrassed when I read your comment, I didn't think you intended to make me look foolish - nor do I really think I did look foolish, just uninformed.

My reply was merely a "mea culpa", and the note about removing the previous comment was more about removing inaccurate information than about saving face.

I think you must remember at least one password, and everything else is in Keepass database. I also do the same thing.

Exactly

Some people rely too much on "one password" solutions, because of security, etc

But it's very easy to lock yourself out of everything. Very easy.

The best place for keeping important passwords is still my head.

Sure, you can use password management solutions, just keep a backup (piece of paper, secondary means of logging, etc)

If you were ever in an accident, or became incapacitated, those passwords would be irretrievable in your head.

I think that a software password manager (regularly backed up) with a master password stored in a secure (offline) location is the best solution.

Yes, your password DB should be backed up in a couple of places, and of course, keep the master password offline securely as well. I don't use a ready made solution, but something similar with GPG

And don't forget to test the backups periodically, and check the master password

I know my DropBox password, and I know my KeePass password. I honestly thought that was enough, under the assumption that a) if my DropBox account was inaccessible, those files would still be on my hard drive, and b) if my laptop were lost or destroyed, I could still log into the web interface and grab the files from there.

I've corrected that assumption now.

I've always kind of worried about scenarios like this given my dependence on 1Password. To mitigate, I ended up getting 1Password for my phone so that I can access my passwords, even if my computer falls in a lake. I also try to avoid treating Dropbox like a backup. It's great for syncing, and I know they keep revisions, but I have a local TimeMachine backup, as well as an offsite backup through Backblaze (still need a password from my database for this). I could always recover my passwords from the TimeMachine backup if all my devices were to disappear at once.

You can also save the 1Password.html file where ever you want and access your passwords via any web browser with out the need for any 1Password app. It is a fully self-contained html app with all of the css, js and images (as data url's) included.

http://help.agilebits.com/1Password3/1passwordanywhere.html

Reply on news.ycombinator.com