• After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.

Evernote Got Hacked!

Be nice if they emailed users and communicated with us. All I saw was the failed password log-in and then the forced reset. Which made me think that I was hacked as an individual.

Then hours later I read about it on ABC News.

Nice communication skills guys. I guess your CEO didn't deserve to be disturbed over the weekend over something so trivial.
 
That was enough to delete my account. But I don't really use or need it anyway, so no loss. ;-)
 
If you keep anything of value on a cloud site like Evernote and don't have two-factor security... well, that's just silly.

I do use Evernote. I keep simple lists of products I rarely buy like the part number for printer ink... and other model numbers for products I own.

If someone hacks my Evernote account... well, they know what sort of cat food I buy, ink I use, when I last change the battery in fire alarms, and.. lots of other trivial data.
 
I don't store nothing of importance on the cloud either. If someone hack any account of mine, they will not get anything worth hacking for!
 
Alright, so I have calmed down a little over the hack. Found out that evernote hash and salts their passwords. So, a sophisticated password could not be obtained by the hackers.

However, I have lost a significant amount of faith in the management of evernote. As I don't believe that they handled this issue professionally or well. As far as I can tell their response to this was to initially post about it on their blog and post simple statements that passwords are being reset on their facebook and twitter. Then hours later the news agencies reported it. Then hours after that MOST users got an email detailing the security breech. (I received one at least eight hours AFTER being prompted to change my password and my daughter has not received one as of now.) This is not in any way a responsible way to warn users.

If they are this incompetent regarding communicating about a serious issue like a hack that allowed the exposure of email addresses and passwords - why should I continue to have faith in them???

The good..
Evernote was hacked like many other companies simply because large companies are constantly bombarded by hackers. In some ways this should surprise no one and generally it is a matter of time. To evernote's credit, they did take good security precautions internally regarding the possibility of a hack.

The bad...
Their response was slow, incomplete and incompetent.
 
Call me cynical, but I don't think their response was based on incompetence. It was a strategic choice not to fan the flames and hope it would blow over. But then the press picks up on it (how could they think it wouldn't) and they were forced to do damage control.

It's interesting that , no matter if it's a kid or a large corporation, getting caught with your pants down produces a lot of the same behavior.
 
mikedt said:
If you're going to store anything in the cloud, just assume it could go public at any time.
Click to expand...

This is why I do not use cloud storage for anything sensitive like financial data. Aside from external hackers, I have no knowledge of how information might be protected from employees or their hiring practices.
 
It sounds like Evernote handled it just fine. Yes they started with a low key response but there is nothing wrong with that because if you act panic - people respond with panic which causes more problems as people flood the service causing service outages, more speculation etc, etc, etc. They were of course forced to put out higher profile responses as the story was picked up in the media - this is a good thing too. A lot of companies in the past had a tendency to batten down the hatches and not tell anyone what was going on. Evernote on the other hand did let people know what was happening and what as being done.

As for the security of storing information in the cloud. It becomes a matter of sensitivity. If it is information that you don't care about people knowing, then don't worry about it being in the cloud behind more than the account login. If your somewhat concern about it then use Evernote's functions for encrypting notes. If you are really concerned about it - then encrypt it separately yourself and then store it where ever you want.
 
Seanette said:
This is why I do not use cloud storage for anything sensitive like financial data. Aside from external hackers, I have no knowledge of how information might be protected from employees or their hiring practices.
Click to expand...

Hmm... Maybe not a good idea to put my nude photos and sex videos on Cloud...
 
nomarsgirl said:
I never use it anyway so I uninstalled.
Click to expand...

I am not sure if this is still the case, but - like facebook - you cannot delete your evernote account. You can only "deactive" it. And as you know, uninstalling does nothing to your account.

In short, your name and password on an active or deactive account are still on the servers.

If you don't plan on using evernote ever again, you should delete everything, change profile info and change the password to something you never have or never will use again. Perhaps: 1dontuseevernote

Then you can completely forget about it and not worry about an old or currently used password being found one day.
 
gtbarry said:
I am not sure if this is still the case, but - like facebook - you cannot delete your evernote account. You can only "deactive" it. And as you know, uninstalling does nothing to your account.

In short, your name and password on an active or deactive account are still on the servers.

If you don't plan on using evernote ever again, you should delete everything, change profile info and change the password to something you never have or never will use again. Perhaps: 1dontuseevernote

Then you can completely forget about it and not worry about an old or currently used password being found one day.
Click to expand...

I only used it for grocery lists. If someone is interested in those, they are welcome to them.
 
Turned out the only thing I had in mine was a welcome message, but I reset my password anyway to make sure I had one that was nothing like any other password I use anywhere.
 
Update: well after 24 hours after I checked in on my Evernote, I found a message in the relevant e-mail account, supposedly received 9 hours before, "breaking" the news. :rolleyes:
 
You must log in or register to reply here.
Back
Top Bottom