The Dropbox hack is real
&gt; As for Dropbox, they seem to have handled this really well.<p>I&#x27;m biased, but I can&#x27;t agree with this. From what I can tell, there are two communications from Dropbox -- one in 2012 [1] and one last week [2].<p>In 2012 they did not disclose that hashes were stolen, so I don&#x27;t see how it&#x27;s really relevant. In the latest communication, they don&#x27;t actually explain the risk to the user. They say it is &quot;purely as a preventative measure&quot; but if salts and hashes were accessed, then that is not the case.<p>Just because Troy doesn&#x27;t have access to some of the salts, doesn&#x27;t mean the attacker doesn&#x27;t have access. We don&#x27;t know how many iterations of SHA-1, but SHA-1 can be run by a single GPU on the order of billions of times per second. So unless Dropbox is coming out and saying they know for certain that random 128-bit salts were definitely not accessed by the attacker, almost all of the SHA1 hashed passwords are getting cracked. Users need to know their passwords are exposed, and must be reset not as a preventative measure, but because they are almost certain to be compromised.<p>As for the salted&#x2F;bcrypt passwords, we can see from Troy&#x27;s hash they used $2a$08$ which is bcrypt with a cost factor of 8 -- 2^8 iterations. Gosney&#x27;s latest rig [3] could crack these bcrypt hashes at about 105,700 &#x2F; 8 = 13,212 per second. That&#x27;s not terrible, but that&#x27;s still 416 billion tries in a year for a modest investment.<p>[1] - <a href="https:&#x2F;&#x2F;blogs.dropbox.com&#x2F;dropbox&#x2F;2012&#x2F;07&#x2F;security-update-new-features&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blogs.dropbox.com&#x2F;dropbox&#x2F;2012&#x2F;07&#x2F;security-update-ne...</a>
[2] - <a href="https:&#x2F;&#x2F;blogs.dropbox.com&#x2F;dropbox&#x2F;2016&#x2F;08&#x2F;resetting-passwords-to-keep-your-files-safe&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blogs.dropbox.com&#x2F;dropbox&#x2F;2016&#x2F;08&#x2F;resetting-password...</a>
[3] - <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;epixoip&#x2F;a83d38f412b4737e99bbef804a270c40" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;epixoip&#x2F;a83d38f412b4737e99bbef804a27...</a>