Dropbox two-step verification security option to lock down your files available to test now
Everyone knows that your primary email account is the lynchpin of your digital security: if someone gains access to that it's likely you could face quite a bit of damage, not unlike what happened to Mat Honan earlier this month.
Context & Ripple Effects
Dropbox is shipping two-step verification as a testable option weeks after disclosing that some user accounts were hijacked and spam attacks hit its users in July 2012 — a stretch that also included an outage and a suspected address leak. The move lands amid broader anxiety over account-takeover chains, crystallized by Mat Honan's August 2012 hack, in which attackers used his primary email to wipe his devices.
The rollout also answers older criticism: Miguel de Icaza flagged Dropbox's security gaps back in April 2011, and the company has since been competing on more than storage, having boosted Pro plans in July 2012 as rivals like Box.net heat up. Eight outlets — from Krebs on Security to Gizmodo and Mashable — picked up the verification news, signaling how closely the security story is being watched.
First-order effects
- Users who opt in get a second factor guarding their files, so a compromised primary email or stolen password alone no longer opens their Dropbox.
Second-order effects
- Rival sync-and-storage services face pressure to match two-factor support quickly, shifting competition from storage quotas toward authentication features.
Third-order effects
- If the pattern holds, password-only login becomes untenable for consumer cloud services, and the email-account-as-master-key recovery chain becomes the industry-wide attack surface regulators and users scrutinize.
The trend: High-profile account compromises are pushing consumer cloud providers to make two-factor authentication a baseline feature rather than an enterprise add-on.