Dalam hal ini, password untuk sign tanda tangan elektroniknya juga kena masalah?, soalnya ada juga teman kantor yang pakai dropbox untuk tanda tangan elektronik.
Dari yang ane pahami, sepertinya password yang dimaksud ini adalah password akun penggunanya, alias password login.
-snip-Bukankah di dropbox ada fitur two-factor authentication (2FA) kan ya? Kalaupun misalkan password memang diduga 'bocor' sekalipun, mestinya masih mesti melewati fitur tersebut lebih dulu untuk sign in.
Mengenai layanan sign e-signature Dropbox ini, saya baca pada tulisan respon dari Dropbox* mengenai kasus tersebut di
https://sign.dropbox.com/blog/a-recent-security-incident-involving-dropbox-sign, ternyata user yang mengaktifkan 2FA pun mesti mereset ulang kecuali yang menggunakan metode sms.
*
When we became aware of this issue, we launched an investigation with industry-leading forensic investigators to understand what happened and mitigate risks to our users.
Based on our investigation, a third party gained access to a Dropbox Sign automated system configuration tool. The actor compromised a service account that was part of Sign’s back-end, which is a type of non-human account used to execute applications and run automated services. As such, this account had privileges to take a variety of actions within Sign’s production environment. The threat actor then used this access to the production environment to access our customer database.
In response, our security team reset users’ passwords, logged users out of any devices they had connected to Dropbox Sign, and is coordinating the rotation of all API keys and OAuth tokens. We reported this event to data protection regulators and law enforcement.
Customers who use an authenticator app for multi-factor authentication should
reset it. Please delete your existing entry and then reset it. If you use SMS you do not need to take any action.
