Dropbox Password security Dropbox have recently published How Dropbox securely stores your passwords

Is this really more secure than using bcrypt with a complexity of 11 or 12 ?

The password "chain" is secure as its weakest part, so is there any point adding the extra 2 parts in ?

I understand that the Global "pepper" means that a DB dump protects the hashes until that pepper is found, and then each hash is still salted per user, but how much would that slow down people reversing the passwords in the event of a DB leak over simply bcrypting them ?
Is this really more secure than using bcrypt with a complexity of 11
  or 12 ?


It depends. Obviously if you consider everything on their servers compromised this isn't more secure than using a higher workload for the password hashing scheme (PHS). If you assume they can guard their pepper better than their password database then the passwords are irrecoverable from the dump.


  The password "chain" is secure as its weakest part, so is there any
  point adding the extra 2 parts in ?


A chain isn't really the correct analogy here. Assume an attacker can brute-force infinitely many bcrypt hashes but can't get the pepper. There's no way such an attacker could recover the passwords because he can't obtain the hashes required to brute-force them.

A better analogy would be an onion. You can't get to the core (the password) without going through all the layers (pepper, bcrypt, SHA-512).


  I understand that the Global "pepper" means that a DB dump protects
  the hashes until that pepper is found, and then each hash is still
  salted per user, but how much would that slow down people reversing
  the passwords in the event of a DB leak over simply bcrypting them ?


The pepper is a 256-bit AES key. If an attacker doesn't get hands on this one there's no way they can recover the hashes and thus potentially the passwords. However as soon as you have exfiltrated the key, the additional AES encryption has just about 0 influence on the run-time required for brute-forcing a key. So you win in case you can protect the key and you lose nothing if you can't do that.