261–270 of 435 posts
Earlier quoted context omitted.
>- We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). Direct from the DB engineer at top of thread.
If that's the case, How is it that the accessibility preferences are changed without root authorization?
And one of them is writable by anyone -- great security, guys!
Earlier quoted context omitted.
After Rice joined I actually completely stopped using Dropbox, transferred files, and deleted my account.
Ditto; now I use SpiderOak which has a solid no-knowledge replacement, but I hear Box is also good.
Earlier quoted context omitted.
That reminds of how Windows asks you to press "ctrl+alt+del" before typing your account password in some situations, because other software cannot intercept ctrl+ald+del so you know the login prompt is legit.
That was actually designed to avoid typing credentials into "faked" password dialogs. The above mentioned "Secure Desktop" with dimming is not designed for that, but for the, rather hilarious, fact that it is trivial for a Windows program to hit any button on the screen it wants to. Having the permission requests pop up on a "Secure Desktop" prevents a malicious program from hitting the "Allow" button for it's own pe…
Why does dropbox need to bring up a fake dialog? They could do the same with the system one.
On the Linux side, has anybody looked at what installing Dropbox does? I'm guessing it's not going to be different from what it does on a Mac, but it would be nice to know exactly...
Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…
What better way to gain access to users' files than through a startup's free app that demands your password?
Dropbox circumventing security restrictions (albeit for legit reasons) is particularly worrying because they have board members who support warrentless surveillance. In my mind Dropbox became a company not worth supporting when Rice joined Dropbox's board ( http://www.drop-dropbox.com/ ). Personally, with a board member who advocates warrentless surveillance it seems unlikely that we share similar views on the securi…
Got a good alt suggestion?
Totally distributed, works like magic. Being distributed means you do have to blindly trust a third party, but also that don't have to worry about $ per megabite. For example, one of the machines I have in my Syncthing network is a Raspberry Pi with a 3TB drive getting a backup of my laptop $HOME and important stuff from other machines all the time.
Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…
> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install…
Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked.
> This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possibly even making them unavailable without an Apple-issued, potentially App Store-only entitlement.
As alluded to elsewhere in this thread, this is already happening in macOS 10.12. We’ll be switching to the same approach that Steam (among others) do to request accessibility.
Ok. Now that Dropbox is shady as well as overpriced, are there any good alternatives?
I'm looking at this: http://www.tarsnap.com/ HN has mentioned this several times in the past. I'm now looking at the prior comments about this.
Earlier quoted context omitted.
How is it adding itself back to the list after being removed, then? (Not disbelieving you at all, I just haven't understood this part.)
It adds a suid binary to /Library/DropboxHelperTools. This binary executes as root's effective user ID no matter who executes it and adds Dropbox to the accessibility list. Dropbox doesn't save your password. ...But I am wondering why one of these suid binaries is world-writable.