We're making changes to the Community, so you may have received some notifications - thanks for your patience and welcome back. Learn more here.
Forum Discussion
Password changed but user still has access?
Hi - I have a dropbox account which I share with a few people. In effect a single dropbox login and a few people know the password. Some of these access it via the dropbox App. I have changed the pas...
Most systems (e.g. windows) at least require a password entry on reboot - dropbox doesn't even do that - the old credentials are still valid across a reboot, at least on windows, and I suspect other platforms as well.
As far as other platforms not invalidating tokens when passwords change, that doesn't make it right - in fact, the right (i.e. secure) way to do this is to ask on password reset if the current tokens, links, etc. be invalidated. Just because other people jump off a cliff doesn't mean it's a good idea. The basic rule of security is to err on the side of too much authentication, not too little!
