<story><title> Dropbox confirms it got hacked, will offer two-factor authentication</title><url>http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/</url><text></text></story><parent_chain></parent_chain><comment><author>mgurlitz</author><text>&lt;i&gt;&amp;#62; It turns out a Dropbox employee’s account was hacked, allowing access to user e-mail addresses.&lt;/i&gt;&lt;p&gt;This is misleading.&lt;p&gt;&lt;i&gt;&amp;#62; Some Dropbox customer accounts were hacked too, but this was apparently an unrelated matter.&lt;/i&gt;&lt;p&gt;Unrelated how? What I read was: &quot;Our investigation found that usernames and passwords recently stolen from other websites... A stolen password was also used to access an employee Dropbox account&quot;&lt;p&gt;This article dangerously leaves the impression that an intrusion was made into Dropbox&apos;s system to access the employee&apos;s account, and possibly an admin interface. In reality Dropbox let a spammer with a valid email and password look at someone&apos;s files.</text></comment>
<story><title> Dropbox confirms it got hacked, will offer two-factor authentication</title><url>http://arstechnica.com/security/2012/07/dropbox-confirms-it-got-hacked-will-offer-two-factor-authentication/</url><text></text></story><parent_chain></parent_chain><comment><author>FaceKicker</author><text>I wish websites with user accounts would offer the option to &quot;login via email&quot; - as in you&apos;d type in your username (or preferably your email) and maybe a captcha and then you&apos;d login by clicking a link it sends via email afterwards.  Ideally having a password associated with the account at all would be optional.&lt;p&gt;I have a Gmail tab opened just about 100% of the time I&apos;m on the computer, so this would be very convenient for me as an alternative to having to remember passwords for sites that I visit once a month or less (and end up having to get a &quot;password reset&quot; link via email every time I log in anyway), and then I&apos;d only have to keep my Gmail account secure (which I do via 2 factor).</text></comment>