a personal password leak stays personal

what everyone assumed

The two accounts felt like two different worlds. One was a personal login on another service; the other was a work account behind the company’s own walls. Reusing a password you already remember is the most ordinary thing a person does online, and the reasonable belief underneath it is that a leak over there cannot reach over here. The accounts are separate, so the consequences should be separate.

what happened

Earlier that year, a breach at LinkedIn had exposed a large set of member credentials. One of those credentials belonged to a Dropbox employee, and it was the same password that opened a Dropbox corporate account. Attackers took the credential that was already in the open and used it to reach inside. They accessed the document of user email addresses, which is what produced the spam that users started reporting to addresses they had only ever given to Dropbox. In July 2012, Dropbox investigated, told users that a stolen password had been used to reach a document containing email addresses, apologized, and said it had added controls. Then the months began. The credentials taken in that access did not surface, were not traded where anyone could see them, and gave no further sign. For four years the file sat somewhere, intact, waiting.

how it surfaced

In August 2016 the dataset appeared for sale, and the scale that had been quiet since 2012 became a number: credentials for more than 68 million accounts, email addresses paired with salted password hashes, roughly half SHA-1 and half bcrypt. The exact figure that circulated was 68,680,741. At the time of the original breach Dropbox had around 100 million users, so the file represented a large share of the company as it then existed. Dropbox forced password resets for accounts it believed were at risk, and the security researcher Troy Hunt independently verified the data and loaded it into Have I Been Pwned. The 2012 disclosure had named the email addresses. It had not named these.

A password is not attached to the account where it was first used; it is attached to every account where it was used again.

A leak on one service becomes a key on another the moment the same string opens both, and the distance between “personal” and “corporate” is only as wide as the passwords are different.