Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

71–80 of 435 posts

Re: How Dropbox Hacks Your Mac

#71

Post by entilzha »

new299 wrote: post #29

Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…

After Rice joined I actually completely stopped using Dropbox, transferred files, and deleted my account.

Re: How Dropbox Hacks Your Mac

#73

Post by gibrown »

aeharding wrote: post #56
tqkxzugoaupvwqr wrote: post #27

Earlier quoted context omitted.

AMP is not the solution. Anyone willing to use AMP to reduce bloat could also just not add bloat to HTML pages in the first place. And, using AMP itself adds bloat[1]. I couldn’t even read the author’s AMP version without enabling JavaScript. [1] https://www.ampproject.org/docs/get_started/create/basic_mar...

AMP is bastardized HTML used as an excuse to making a website fast in the first place. I totally agree. Additionally, AMP wants to become the arbiter of the mobile web. Just look at their list of "Supported ad networks." [1] Who gave them the authority? AMP worries me greatly. [1] https://github.com/ampproject/amphtml/blob/master/builtins/a...

They've been pretty good about accepting PRs to support any ad network from what I've heard: https://github.com/ampproject/amphtml/pulls?utf8=%E2%9C%93&q...

Re: How Dropbox Hacks Your Mac

#74

Post by Vendan »

pritambaral wrote: post #30
gruez wrote: post #21

The fact that any application can spoof the os password prompt makes me wonder why they don't have a prominent feature to show the prompt is from the OS. On windows there is the secure desktop with the dimming effect.

Is the "secure desktop with dimming effect" not spoofable?

Trivially, in fact, KeePass does a fairly good job of it, mimicing everything down to the actual creation of a second, "secure" desktop. It's arguably more secure, though it's a little bit of a "false security", as KeePass's "Secure Desktop" is not as "secure" as the UAC and similar one, as the UAC one runs as SYSTEM, where as KeePass's runs as the current user.

Re: How Dropbox Hacks Your Mac

#75

Post by gusmd »

gruez wrote: post #21

The fact that any application can spoof the os password prompt makes me wonder why they don't have a prominent feature to show the prompt is from the OS. On windows there is the secure desktop with the dimming effect.

That reminds of how Windows asks you to press "ctrl+alt+del" before typing your account password in some situations, because other software cannot intercept ctrl+ald+del so you know the login prompt is legit.

Re: How Dropbox Hacks Your Mac

#76

Post by Xylakant »

Dylan16807 wrote: post #54
woah wrote: post #16

Earlier quoted context omitted.

If you're going to use a Mac, you're trusting Apple already. How does using iCloud make you trust them more?

Because Apple doesn't have a mechanism to access files on your Mac, while they do have a mechanism to access files on iCloud. This means someone guessing your security questions, or somebody with a warrant, or somebody abusing their access rights can get to your files.

They do provide the OS, so they implicitly have access to all your files at a level that dropbox would have a hard time achieving.

Re: How Dropbox Hacks Your Mac

#77

Post by lm2s »

Dylan16807 wrote: post #61
lm2s wrote: post #53

Earlier quoted context omitted.

You're assuming everyone trusts Dropbox with all their files and that everyone installs their kernel extension, which is a wrong assumption.

If we're worried about theoretical abuse, the client could access all of your files because it runs as you. You can opt out of the kernel extension? Still, you give it root to install, and it has a long history of hacking the file browser to get icon overlays... it seems weird to me that this would be a deciding factor.

I was under the impression that the kernel extension was a separate product, it's being included in the standalone Dropbox application? You do have a point about giving it administrator privileges, the post however shows very clearly that they are abusing your trust which is enough for people to think twice before using their application..

Re: How Dropbox Hacks Your Mac

#78

Post by fredoliveira »

_razvan wrote: post #70
anf wrote: post #59

Earlier quoted context omitted.

What are the legit reasons? Isn't it just reading and writing files to the Dropbox folder?

The accessibility features of the OS are used by Dropbox to implement the Dropbox Badge / Project Harmony feature.

These should definitely be opt-in, however (I don't use the badge), and I would definitely argue that the way they get on the accessibility list is deceptive at best.

Re: How Dropbox Hacks Your Mac

#79

Post by bad_user »

BinaryIdiot wrote: post #55
new299 wrote: post #29

Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…

Honestly they're pretty much the most expensive out of all of the storage solutions. Other than versioning they have less features than their competition as well. If they were born today I can't imagine they would have gone much of anywhere. Not sure how they're doing financially today but it seems each product they create flops. So even outside of this surveillance stuff I don't get the point in using them.

Out of the mainstream ones, they are the only ones supporting Linux.

Re: How Dropbox Hacks Your Mac

#80

Post by eridius »

bahoom wrote: post #69

I'm using the same techniques for my apps to enable accessibility access (which is needed for window management), although I'm asking users for confirmation before doing so. It's kind of hacky, but the standard Apple way (click the tiny lock icon on the bottom left, find the app in the list, click the checkbox) is way to cumbersome for users. Why not displaying a simple yes/no popup similar to the "allow access to co…

> Why not displaying a simple yes/no popup

Because granting accessibility access is far more dangerous than granting access to contacts / calendar. The latter just exposes some of your user data. The former gives the app a huge amount of control over your computer.

Post reply on HN