Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

51–60 of 435 posts

Re: How Dropbox Hacks Your Mac

#51

Post by pyre »

Sir_Cmpwn wrote: post #22
pat2man wrote: post #15

Earlier quoted context omitted.

What happens when you take a laptop to another network?

Everything freaks out, unfortunately. I would work on a better solution, but I'm not particularly inconvenienced by this issue.

Isn't a bit naive to think that your solution, which has obvious flaws is one-size-fits-all?

I use cloud storage (e.g.) have access to my password file between my computers and my mobile devices. NFS shares on ~/share that only work on the local network don't really solve this issue.

Re: How Dropbox Hacks Your Mac

#52

Post by sbarre »

pritambaral wrote: post #30
gruez wrote: post #21

The fact that any application can spoof the os password prompt makes me wonder why they don't have a prominent feature to show the prompt is from the OS. On windows there is the secure desktop with the dimming effect.

Is the "secure desktop with dimming effect" not spoofable?

It probably is, but it would be near-impossible for a respectable company to claim that they weren't specifically trying to spoof it.

With the current OS X password prompt being a benign looking window, Dropbox (or others) can easily say they're just "following standard UI patterns" or something like that.

Re: How Dropbox Hacks Your Mac

#53

Post by lm2s »

Dylan16807 wrote: post #50

I don't really understand the conclusion here. So the scenario is you trust dropbox with your files, and you trust them with a kernel blob implementing the filesystem, but you don't trust them to silently have accessibility rights?

You're assuming everyone trusts Dropbox with all their files and that everyone installs their kernel extension, which is a wrong assumption.

Re: How Dropbox Hacks Your Mac

#54

Post by Dylan16807 »

woah wrote: post #16
Sir_Cmpwn wrote: post #8

Great article, but poor conclusion. He finds that Dropbox is untrustworthy, a finding that likely surprises no one, and reaches for iCloud as the solution. Why move into another walled garden driven by corporate interests? OwnCloud or a similar self hosted solution would be better. I just use NFS and a dead simple storage server to make ~/shared available on all of my machines.

If you're going to use a Mac, you're trusting Apple already. How does using iCloud make you trust them more?

Because Apple doesn't have a mechanism to access files on your Mac, while they do have a mechanism to access files on iCloud. This means someone guessing your security questions, or somebody with a warrant, or somebody abusing their access rights can get to your files.

Re: How Dropbox Hacks Your Mac

#55

Post by BinaryIdiot »

new299 wrote: post #29

Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…

Honestly they're pretty much the most expensive out of all of the storage solutions. Other than versioning they have less features than their competition as well. If they were born today I can't imagine they would have gone much of anywhere. Not sure how they're doing financially today but it seems each product they create flops.

So even outside of this surveillance stuff I don't get the point in using them.

Re: How Dropbox Hacks Your Mac

#56

Post by aeharding »

tqkxzugoaupvwqr wrote: post #27
ejcx wrote: post #2

Just wanted to give the author a shoutout for being awesome. This article is published with an AMP version[0] too, which is pretty unusual for smaller blogging sites. AMP articles are so much easier on my eyes (and the author can't include their own javascript on an AMP page, so there is less bloat). I wish all bloggers started to publish AMP pages. [0] - http://applehelpwriter.com/2016/08/29/discovering-how-dropbo..…

AMP is not the solution. Anyone willing to use AMP to reduce bloat could also just not add bloat to HTML pages in the first place. And, using AMP itself adds bloat[1]. I couldn’t even read the author’s AMP version without enabling JavaScript. [1] https://www.ampproject.org/docs/get_started/create/basic_mar...

AMP is bastardized HTML used as an excuse to making a website fast in the first place. I totally agree.

Additionally, AMP wants to become the arbiter of the mobile web. Just look at their list of "Supported ad networks." [1]

Who gave them the authority?

AMP worries me greatly.

[1] https://github.com/ampproject/amphtml/blob/master/builtins/a...

Re: How Dropbox Hacks Your Mac

#57

Post by Jerry2 »

Sir_Cmpwn wrote: post #33
Myrth wrote: post #26

Earlier quoted context omitted.

And if you're using Ubuntu, you're trusting package managers, and if you're using Gentoo, you're trusting original developers (how often do you audit source code?)

>And if you're using Ubuntu, you're trusting package managers, and if you're using Gentoo, you're trusting original developers This is correct. Consider, however, the motivations of the people involved. Apple's motivations are to make money from you. Debian's motiviations (intentionally avoiding Ubuntu here) are to make a good user-centric system. Packages are signed by named individuals that I can personally get to…

Who do you think employs vast majority of Linux developers? Who do you think writes they paychecks? Ever looked into who the biggest Red Hat customer is? Hint, it's the DoD.

Re: How Dropbox Hacks Your Mac

#58

Post by Sir_Cmpwn »

pyre wrote: post #51
Sir_Cmpwn wrote: post #22

Earlier quoted context omitted.

Everything freaks out, unfortunately. I would work on a better solution, but I'm not particularly inconvenienced by this issue.

Isn't a bit naive to think that your solution, which has obvious flaws is one-size-fits-all? I use cloud storage (e.g.) have access to my password file between my computers and my mobile devices. NFS shares on ~/share that only work on the local network don't really solve this issue.

Did I say it was a one-size-fits-all, or that it was flawless? I also suggested OwnCloud before describing my own setup. All of your software choices come with tradeoffs.

For my passwords I use pass and store them in a private git repo on a server I trust. http://password-store.org

Re: How Dropbox Hacks Your Mac

#59

Post by anf »

new299 wrote: post #29

Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…

What are the legit reasons? Isn't it just reading and writing files to the Dropbox folder?

Re: How Dropbox Hacks Your Mac

#60

Post by BinaryIdiot »

pritambaral wrote: post #30
gruez wrote: post #21

The fact that any application can spoof the os password prompt makes me wonder why they don't have a prominent feature to show the prompt is from the OS. On windows there is the secure desktop with the dimming effect.

Is the "secure desktop with dimming effect" not spoofable?

Not really. Sure you can make a replica of it but it won't behave the same because you'll be able to minimize or close it but the secure desktop you can't do jack to until you either accept to decline whatever it's asking.
Post reply on HN