DropBox Left Users With Authentication

Tuesday, June 21, 2011

DropBox Left Users With Authentication

You are sending an email that contains the article
and a private message for your recipient(s).

Your Name:

Your e-mail:

* Required!

Recipient (e-mail):

*

Subject:

*

Introductory Message:

HTML/Text
(Photo: Yes/No)

(At the moment, only Text is allowed...)

Message Text:

Yesterday DropBox made a code update at 1:54pm Pacific time that introduced a bug affecting the service's authentication mechanism.

The company discovered this at 5:41pm and fixed it by 5:46pm. Dropbox said that "a very small number" of users (much less than 1 percent) logged in during that period, some of whom could have logged into an account without the correct password.As a precaution, the company ended all logged in sessions.

The bug would have allowed anyone to log into into someone else?s account simply by typing in their e-mail address.

Dropbox is conducting an investigation of related activity to understand whether any accounts were improperly accessed.