Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- What is Lenovo doing here? Were they bundling Dropbox with their devices?by aitchnyu
- Damn, big security fuckup by Dropbox, how can they portray that as an issue with Lenovo's e-mail verification process? You should never allow linking of an existing account with a new login method without first confirming that the user is able to sign in with an existing method first! Everyone knows this allows easy account takeovers otherwise, that's such a trivial attack vector, truly a scenario you could pose to a junior security engineer in an interview.by ThePhysicist
- This is such a colossal fuckup, they need to do a full postmortem and heads need to roll. This is a "you had one job" situation. This is all hands on deck. This is potentially company-ending. If this happened at Github it would be huge news.by phendrenad2
- > Has anyone else received the same notice, or seen any public information about this vulnerability?
Another submission on HN (to Twitter).
by latexr - I got this same email about an hour ago.
About two weeks ago I received a notification from Dropbox that somebody signed in that I did not recognize. I immediately changed my password and enabled 2FA. There were no open unknown sessions or any activity that seemed suspicious other than that one login.
One odd thing at the time: the Dropbox login page had started offering 'Continue with SSO' for my email even though I never created a Lenovo ID.
by xaphod - Tail lift sluggish first thing in the morning, then fine once the truck's been running a while? That's usually not a fluke — it's tail lift hydraulic oil that has already aged past its ideal working condition. Cold weather just makes the viscosity issue more obvious. Check the fluid color before you assume it's a mechanical fault.by tomsop