Dropbox Introduces 2-Factor Authentication

[SwaroopH]

Try this: https://www.dropbox.com/try_twofactor

Although tray login still logs you in without the need to enter password or the code.

[lowe]

here's the full context from dropbox forums: https://forums.dropbox.com/topic.php?id=66910

[guylhem]

Not working for Martinique (FWI), country code 596. Still waiting for a SMS to come. Asked twice 5 and 10 minutes ago.

Maybe the country list should be edited to only list countries where SMS can be sent? (I have no problem with other 2-ways services I use)

[irunbackwards]

That worked, thanks! Also, I just discovered a checkbox under 'Account Settings' that seems like it's an opt-in for early releases. OP probably already had this checked?

[josteink]

Worked for me. In Norway, for those curious.

[joshzayin]

More details: https://www.dropbox.com/help/363/en

It looks like they support any app that uses the TOTP protocol, so google authenticator, among others, works with this seamlessly.

[icebraining]

That's nice. A little context: TOTP is part of OATH - Initiative for Open Authentication - and is an open standard published as RFC 6238.

For those who don't have iOS/Android/BB and/or don't want to use Google Authenticator, Wikipedia lists a few compatible applications: https://en.wikipedia.org/wiki/Google_Authenticator

These work for Gmail too.

[ch0wn]

I'm glad they didn't invent their own mechanism but used standard OTP tokens, so you can just add them to apps like Google Authenticator.

[spindritf]

This is very convenient, Google Accounts, Amazon AWS[1], SSH[2], and Dropbox, all from one simple app.

If Google Authenticator allowed to change the order of accounts without removing and readding them, I would have absolutely nothing to complain about.

[1] https://aws.amazon.com/mfa/faqs/

[2] http://askubuntu.com/questions/159727/how-can-i-use-a-passco...

[teach]

I don't see any mention of 2-factor auth on the linked page. Maybe they're rolling it out in stages?

[irunbackwards]

Seems like it to me as well, I don't see any options to do 2-factor auth on my settings page either. Maybe it's a pro feature right now?

[forsaken]

I upgraded my account, and now the desktop client is not letting me login, saying I need the latest client. I downloaded that and it still gives me the same error..

[dkulchenko]

You'll need their "experimental build": https://forums.dropbox.com/topic.php?id=66910

[steveeq1]

Does anyone know where I can download the latest Linux binary that support 2 factor authentication? I tried downloading the linux version, but it keeps on saying "this account uses two-step verification. To link to it, please download the latest version of Dropbox from www.dropbox.com/download". Maybe there is no new linux client, not sure.

[lowe]

Sorry for the confusion, this was a forum release. Linux build is here:

https://forums.dropbox.com/topic.php?id=66910

[jrockway]

Well done. I wish more sites would move to using standard OTP protocols. I hate having to carry around and use a separate dongle for each company that provides two factor authentication.

[batgaijin]

Great, now only if they actually encrypted my files.

[matwood]

Put a truecrypt volume in your DropBox. Why rely on someone else to do the encryption?

[SCdF]

Spideroak works pretty well for me as a secure Dropbox replacement :-)

[irunbackwards]

You seem like you'd be appreciative of this service: http://getsecretsync.com/ss/

[bschlinker]

Get Boxcryptor.

[peterwwillis]

If you want to get the most out of this, use a hardware token generator instead of a phone or computer. Example: http://hackaday.com/2012/07/11/time-based-one-time-passwords... http://lab.infoserver.com.br/wiki/index.php/Projects:arduino...

[mertd]

That looks like a software generator running on Arduino.

[septerr]

Carrying a set of backup codes when travelling, generating a code for each app that is linked to your account...these things make two way authentication seem very inconvenient. I went with converting my gmail account to use two way authentication but after being informed to remember to carry a set of 10 backup codes when I am going to be without my phone, was a turn off and I reverted to my old settings.

[treelovinhippie]

Hmm, but I can still simply open someone's Dropbox folder locally if they forgot to logoff/switch on their computer...

[dkokelley]

That requires physical access, which is arguably more secure than internet access should your credentials be compromised. This is a major step in the right direction for Dropbox. I don't think it's Dropbox's job to encrypt and secure my local files. This would break many use cases, and there are other purpose-built solutions for this.

Dropbox made their business on an extreme convenience (your files everywhere through a dead-simple, familiar interface). Inconveniently, convenience is often the enemy of security. It's a "good thing" that Dropbox is now offering some granularity over the convenience/security spectrum.

[bigiain]

That's hardly an unexpected security hole - most of my devices maintain local copies of everything in my Dropbox folder (phone/iPad excepted). Requiring password/two factor auth to get at the cloud hosted version of something in the local filesystem would achieve pretty much nothing.

Maybe there's people using Dropbox in some other fashion, but surely this is the intended/common use case?

[reledi]

My security codes aren't working (invalid). Using Google Authenticator.

Anyone else have this issue?

[sinsear]

Yup, have the same issue, went with sms-version because of this ;(. Google Authenticator on HTC Desire HD with custom ROM

[mjs7231]

Yeay, now I can have a really secure login to my insecure files?

[mwww]

Two-Factor authentication sucks. It's too hard for users. Most people will never us it. Dropbox should consider using Rublon (yes, that's my startup): https://rublon.com

7 reasons why you should add Rublon to your website: http://blog.rublon.com/2012/why-add-rublon/

[rdl]

1) Screw outsourcing your authentication database to a third party, or incorporating third-party JS, as a mandatory thing. It's ok if you build something (like OATH) which allows a third-party service provider, but it shouldn't be mandatory; you should be able to implement the entire thing on your own infrastructure, and ideally play nicely with other sites in a user-selected client (potentially a browser).

2) I'd rather just do N-factor using a client cert stored in the web browser (mobile or desktop), combined with a password. x509 is probably terminally defective in desktop browsers due to historical accident and a messy protocol, but it could work on mobile, and stuff like OneID or BrowserID could meet the same need for regular browsers.

I don't believe in desktop + cellphone both being required to log into every site every time. The OATH compromise (using the phone periodically, along with a desktop password, and caching something in the browser) is an acceptable compromise for some apps.

Ultimately what I want is trusted keystore of asymmetric private keys on devices, and then multifactor auth to the keystore (biometric, password, location/time based heuristics, etc.), and reasonable management of keystores and keys (so I can for instance revoke every key on my phone if stolen, or disallow ipad and iphone but not mba13 for dropbox, but allow all 3 for linkedin)

The technical problem is relatively simple; it's an integration program (the auth libraries used by every site, plus mobile OSes, maybe desktop OSes, and hardware in phones and computers).

Give users the ability to make their own choices, and let sites establish minimum standards as well. I should be allowed to make a site depend on fingerprint swipe + physical location + specific machine if I want, but it shouldn't be mandatory for a random game site for everyone/anyone.

[Serplat]

This completely misses the point of Two-factor authentication, though.

Two-factor authentication is all about increasing security by combining two separate factors: something you know (password), and something you have (phone). From what I can tell, you're just switching from relying on one factor (password) to relying on the other factor (phone). It's just a different one-factor authentication paradigm.

Unfortunately, this leaves several gaps. For example, what happens when I lose my phone, or someone takes it from me? Can that other person log in immediately?

I can potentially understand an argument that this is more secure than solely password-based solutions (although I don't think it would be for me, where I use complex random passwords), but I certainly wouldn't consider it an alternative to two-factor authentication.

[teach]

I've never heard of Rublon before now, but this post has started me off with a pretty negative impression.

I'd suggest you work on your elevator pitch a bit more.

[mwww]

Thanks for your opinion guys. Looks like we'll have to invest much more time in creating a new website that will explain Rublon more precisely. I can see that there is way too much confusion and misunderstanding about the product.

[alexlitov]

How entering 6 digits hard for users?

[spindritf]

This is neat but only requires a phone, there's no second factor.

[ragmondo]

How about this for a novel idea. Stop inventing new mechanisms for autentication, and let ME choose how I authenticate myself to your service (to gain access to MY data). http://ragmondocom.appspot.com/2012/03/My-Stuff-My-Lock

[joshu]

how is the phone not a second factor?

[adgar]

> Two-Factor authentication sucks. It's too hard for users.

It must be easier to build a startup on the assumption that your users are incompetent mouthbreathers. Respecting your users is hard work :-/