Also of note is that Dropbox does not force complex passwords: http://i.imgur.com/v4h0g8D.png
Hashes, cryptographic hashes included, are designed to be fast. Unfortunately, that means that they're also fast to brute force.
Use bcrypt[1] or a proper key derivation function[2] like PBKDF2[3]
[1] http://en.wikipedia.org/wiki/Bcrypt
FYI, don't try and "fix" this by erasing the top password and filling your old one in... that will cause safari to forget that you're generating a new password, and it won't commit the new password to the keychain (and you're now locked out.)
Safari fares better on the password reset link though, which has two "new password" fields and that's it.
EDIT: Dropbox say the leak is from another service that has been compromised. Does anyone know of a service that's been popular enough to store ~7'000'000 user credentials without instead using OAuth? If there is, how did Dropbox not notice that, and how did we ad the Internet community not complain about this service sooner? I assume 7 million accounts aren't immaterial to Dropbox total users.
LinkedIn leaked 6.5 Million hashed but not salted passwords back in 2012, for example.
The update from Dropbox:
Dropbox has not been hacked. These usernames and passwords were unfortunately stolen from other services and used in attempts to log in to Dropbox accounts. We'd previously detected these attacks and the vast majority of the passwords posted have been expired for some time now. All other remaining passwords have been expired as well.
It's ridiculously easy and worthwhile.
