Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

131–140 of 435 posts

Re: How Dropbox Hacks Your Mac

#131

Post by dogecoinbase »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

The dialog box you see is a native OS X API (i.e. made by Apple).

Which API are you using that allows you to circumvent the OS X Accessibility Permissions control dialog? Or do you mean you're simply asking for administrative permissions in order to write directly to TCC.db? And in that case, what mechanism are you using to circumvent the permissions structure to permit you to rewrite to TCC.db without re-requesting the user's permission?

Re: How Dropbox Hacks Your Mac

#132

Post by aioprisan »

Jerry2 wrote: post #57
Sir_Cmpwn wrote: post #33

Earlier quoted context omitted.

>And if you're using Ubuntu, you're trusting package managers, and if you're using Gentoo, you're trusting original developers This is correct. Consider, however, the motivations of the people involved. Apple's motivations are to make money from you. Debian's motiviations (intentionally avoiding Ubuntu here) are to make a good user-centric system. Packages are signed by named individuals that I can personally get to…

Who do you think employs vast majority of Linux developers? Who do you think writes they paychecks? Ever looked into who the biggest Red Hat customer is? Hint, it's the DoD.

Source?

Re: How Dropbox Hacks Your Mac

#134

Post by aioprisan »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

I still don't understand how this allows for accessibility circumvention dialog.

Re: How Dropbox Hacks Your Mac

#135

Post by elmigranto »

bahoom wrote: post #93
eridius wrote: post #80

Earlier quoted context omitted.

> Why not displaying a simple yes/no popup Because granting accessibility access is far more dangerous than granting access to contacts / calendar. The latter just exposes some of your user data. The former gives the app a huge amount of control over your computer.

What exactly is so dangerous? Any app can take screenshots , listen to keyboard entries, send keys, move the mouse pointer and upload stuff to a server without any AXApi permission. Forbidding window movement doesn't add any security at all. Anyways, all I want a simple prompt explaining what the Accessibility API does and yes/no buttons.

One example that comes to my mind, is that you won't be able to copy any data from keychain. In fact, no one can access protected keychain data, if any app that is not in Accessibility "listens to keyboard".

http://apple.stackexchange.com/questions/212622/keychain-won...

Re: How Dropbox Hacks Your Mac

#136

Post by xenadu02 »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

Can you also tell us why Dropbox eats lots of CPU cycles anytime there is any filesystem activity?

If I unzip a large archive in /tmp, Dropbox is eating 60% of my CPU.

If I open the new Xcode for the first time (and the system verifies all the signatures) Dropbox is eating 100% of one CPU.

It really seems like the Dropbox client is monitoring the entire filesystem (all FSEvents) instead of just the dropbox syncing folders, and doing it relatively inefficiently at that.

At this point if I'm doing anything filesystem intensive I close Dropbox first.

Re: How Dropbox Hacks Your Mac

#137

Post by toomim »

thenewwazoo wrote: post #104
tomku wrote: post #6

Non-clickbait title: "How Dropbox uses the root access that you give it during installation to give itself Accessibility authorization without triggering the usual popup".

Corrected proposed non-clickbait title: "How Dropbox fakes an authorization prompt to trick you into entering credentials that it then caches in order to bypass restrictions on what root is able to do so that it can persist a security bypass mechanism." The first bit, for me, is key.

It doesn't do that. It doesn't cache the credentials. It doesn't even see your password.

Re: How Dropbox Hacks Your Mac

#138

Post by yyyuuu »

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like.

- We use accessibility APIs for the Dropbox badge (Office integrations) and other integrations (finding windows & other UI interactions). - We use elevated access for where the built-in FS APIs come up short. We've been working with Apple to eliminate this dependency and we should have what we need soon.

- We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). - We check and set privileges on startup — the intent was to make sure Dropbox is functioning properly, works across OS updates, etc. The intent was never to frustrate people or override their choices.

We’re all jumping on this. We’ll do a better job here and we’re sorry for any anger, frustration or confusion we’ve caused.

Re: How Dropbox Hacks Your Mac

#139

Post by mary_fortran »

(Hello! This is my first comment on HN!)

I knew something was odd with DropBox because I never saw any other application provide the level of integration they did. After the DropBox hacks, I reevaluated my security needs and the value I got from DropBox and decided to switch to OneDrive.

OneDrive's shell integration on the Mac isn't as good as DropBox's. Microsoft is aware of this and says they're trying to address it.

Now I know why it's so hard to do! If you want to play by the rules, you can't get the seamless integration you need.

Even with the restrictions though, OneDrive works pretty well on the Mac.

Re: How Dropbox Hacks Your Mac

#140

Post by 0x0 »

yyyuuu wrote: post #138

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

Ben, do you have two HN accounts? This one and that one too: https://news.ycombinator.com/item?id=12464730 ?
Post reply on HN