evernoteNote-taking service Evernote today released a statement announcing that it had discovered suspicious activity on the Evernote network, which prompted it to issue a service-wide password reset.

While Evernote says that no content or payment information was accessed, hackers did acquire usernames, email addresses, and encrypted passwords.

In our security investigation, we have found no evidence that any of the content you store in Evernote was accessed, changed or lost. We also have no evidence that any payment information for Evernote Premium or Evernote Business customers was accessed.

The investigation has shown, however, that the individual(s) responsible were able to gain access to Evernote user information, which includes usernames, email addresses associated with Evernote accounts and encrypted passwords. Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.)

All Evernote users will be prompted to choose a new password when logging in to the website. The company is is also releasing updates to several of its apps today to facilitate the password change.

Evernote's security breach comes a bit over a week after Apple, Twitter, and Facebook were hacked when employees visited iPhoneDevSDK, an online forum for software developers.

Top Rated Comments

jennyp Avatar
120 months ago
I have a 20 character master password with 1Passsword. If I go to the site below and enter a password mask (I would never enter my actual password in anything other than 1Password), it would take sextillion years to crack my password.

http://howsecureismypassword.net

That isn't strictly true. Your password could be cracked in the first 5 minutes of a run. It's highly unlikely, true, but the proper way to state matters would be to say that it would take that length of time to try all combinations of the characters you use.

</pedantry>
Score: 2 Votes (Like | Disagree)
canyonblue737 Avatar
120 months ago
I never got an email either but I think I know why... evernote sent the email from a NON-evernote domain that was only registered a few months ago and who's ID looks like it doesn't belong to evernote. It looks EXACTLY like a classic fishing scheme... except evernote has admit it really was from them. Many email services grab these messages because they look so obviously fake. They are now saying on the forums it was due to this happening in the midst of a big email server switch for them and this was the only way they could send out 50 million emails on short notice. To me it says that this is a big company still playing amateur hour when it comes to user security.

1. no 2 factor authentication.
2. SSL only when sending data to their servers.
3. no encryption of ANY KIND of ANY of your notes or notebooks on their servers. if someone gets your primary password, everything is exposed.
4. poor handling of the large data leak... email response, style and timing was all beyond poor. all passwords reset prior to ANY email, twitter, homepage or any other notification sent from evernote. the error alert saturday morning on evernote.com and in apps simply said you were entering the wrong password leading thousands to think they had been hacked with nothing at all explaining what had really happened.

this is a company that proudly has articles on their website saying "how to use evernote at tax time" but does nothing at all to protect the critical nature of user information on their servers. no one does this as poorly in the crowd they want to play in: apple, twitter, google, dropbox etc. it is downright irresponsible for them to imply that critical user data is safe and they haven't even hinted they want to improve it ('cept for 2 factor which they have been implying for a year and never arrived even with the big 5.0 update.)

i hope evernote stops what they are doing, realizes they are becoming a MAJOR player in the cloud space and with 60 million accounts they have to do FAR better. evernote has been iterating like mad on their service which has brought them great success but they need to pour their resources into security they desperately need starting with 2 factor authentication and the ability to encrypt notebooks. only then will evernote be a modern, secure cloud service to store your life's most valuable information.
Score: 1 Votes (Like | Disagree)
japanime Avatar
120 months ago
I use Evernote but didn't seem to receive the email warning of the password breach. It certainly wasn't in my inbox.

So, I just searched my Mail.app and discovered that Apple's junk-mail filter had put the Evernote email directly into the trash. :confused:
Score: 1 Votes (Like | Disagree)
turtle777 Avatar
120 months ago
For instance, 1password or wallet use icloud or dropbox to sync between devices and for backup. Should someone get my sync file, they have all the time in the world to try to get passed the encryption/masterpassword and access to all my passwords.

In case of 1PW, they would need all the time in the world.

As long as you use a long and safe Master Password, encrypted data in the cloud is not an issue.

They will go for a dictionary attack before they try to decrypt your contents.

-t
Score: 1 Votes (Like | Disagree)
maxosx Avatar
120 months ago
This event simply emphasizes the value of taking one's password & security plan seriously.

By keeping it dynamic with regular changing of passwords & executing procedures as suggested by those above, one is relatively safe.
Score: 1 Votes (Like | Disagree)
furi0usbee Avatar
120 months ago
One way is to have your own domain and a hosting service with unlimited number of convenient mail aliases. Also makes it easy to shutdown an address if it starts to get spam...

1Password is really nice.

I have several websites/domains, but I would never want to take the time to start using a separate email now for each account. Even though I could just do mymail1@, mymail2@, and just forward them to a master account, I don't feel the need to do that just now. It's better security that's for sure, but I don't know if I need that now. But I will put that on my list of things to consider.

What I do thought, is lie when presented with secret questions for my accounts. So if it says what state was I born, I say any state other than my own. When it says first car, I say some nice Italian number, etc.

Bryan
Score: 1 Votes (Like | Disagree)

Popular Stories

RIP iPod Feature

RIP iPod: A Look Back at Apple's Iconic Music Player Over the Years

Friday May 13, 2022 2:25 pm PDT by
Apple earlier this week announced the discontinuation of the iPod touch, and because it was the last iPod still available for purchase, its sunsetting effectively marks the end of the entire iPod lineup. To send the iPod on its way, we thought it would be fun to take a look back at some of the most notable iPod releases over the last 21 years. Original iPod (2001) Introduced in October...
iOS 16 mock for article

Gurman: iOS 16 to Include New Ways of System Interaction and 'Fresh Apple Apps'

Sunday May 15, 2022 6:14 am PDT by
iOS 16 will include new ways of interacting with the system and some "fresh Apple apps," Bloomberg's Mark Gurman has said, offering some more detail on what Apple has in store for the upcoming release of iOS and iPadOS set to be announced in a few weeks at WWDC. In the latest edition of his Power On newsletter, Gurman wrote that while iOS 16 is not likely to introduce a major face-lift to...
14 16 inch 2021 mbps back to back feature orange

Five Things You Still Can't Do With a MacBook Pro

Wednesday May 11, 2022 11:16 am PDT by
It's been over 200 days since Apple debuted its redesigned MacBook Pro lineup. Offered in 14-inch and 16-inch display sizes, the new-look MacBooks wowed Apple fans and creative pros alike with their powerful custom Apple silicon, mini-LED screen, and multiple connectivity options. But there are still some things you can't do with a MacBook Pro. Here are five features some Mac users are still...
iOS 16 mock for article

Which Devices Will iOS 16 and iPadOS 16 Support?

Thursday May 12, 2022 7:29 am PDT by
While there are as yet no concrete rumors related to which devices iOS 16 and iPadOS 16 will support, the discontinuation of the iPod touch earlier this week may be an indication that as many as nine devices could be about to lose support for Apple's upcoming operating systems. iOS and iPadOS 13, 14, and 15 support all of the same devices, with the iPhone 6S and iPhone 6S Plus,...
apple mac ipad watch trade in

Apple Launches Limited-Time Bonus Trade-In Credit for iPhone, iPad, Mac, and Apple Watch in Many Countries

Wednesday May 11, 2022 5:14 am PDT by
Apple has launched a special limited-time offer for iPhone, Apple Watch, Mac, and iPad trade-in that offers customers additional credit when trading in their only device for a new one. The offer is being run in several countries including the US, UK, Germany, Spain, Italy, South Korea, Japan, Taiwan, China, India, and France. In the UK, Apple is offering up to £50 of extra trade-in credit...
sony

Sony Unveils Redesigned WH-1000XM5 Headphones With Improved Noise Cancelation

Thursday May 12, 2022 9:26 am PDT by
Sony's flagship WH-1000XM4 noise-canceling headphones have been among the best on the market for some time, and today Sony announced its fifth-generation WH-1000XM5 headphones, boasting a new design and several improvements over the previous model. The redesigned headphones replace the shrouded arms that swivel on the XM4's with an exposed arm that has a single contact point at the earcups,...
apple tv 4k design clue

Kuo: New Apple TV to Launch in Second Half of 2022, Lower Price Possible

Friday May 13, 2022 7:58 am PDT by
Apple plans to launch a new version of the Apple TV in the second half of 2022, according to well-known analyst Ming-Chi Kuo. In a tweet today, Kuo said the new Apple TV will have an improved cost structure, suggesting that the device could have a lower price that is more competitive with other streaming media players like Google's Chromecast line, Amazon's Fire TV line, and the Roku line. ...
iPhone 14 Purple Feature

Full Range of iPhone 14 Color Options Revealed by Purported Leak From China

Wednesday May 11, 2022 2:20 am PDT by
The iPhone 14 and iPhone 14 Pro models will be available in a refreshed range of color options, including an all-new purple color, according to a recent rumor. The claim comes from a post on Chinese social media site Weibo by an unverified source and purports to reveal the full range of color options for Apple's upcoming iPhone 14 and iPhone 14 Pro models. Compared to the selection of color...