Dropbox let a rogue Lenovo SSO silently hijack accounts. No password check, no step-up, no consent.
Classic broken-trust federation: never auto-link identity based on an unverified email claim from a third-party Identity Provider.
Zero-trust the trust broker too.
9to5mac.com
Dropbox breach seemingly caused by egregious authentication failure - 9to5Mac
Multiple Dropbox users have been emailed by the cloud storage company to advise them that a security breach saw unauthorised...