Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

281–290 of 435 posts

Re: How Dropbox Hacks Your Mac

#281

Post by guitarbill »

chris_7 wrote: post #241
lucb1e wrote: post #237

Earlier quoted context omitted.

> they have all your files already Hell no they don't? They have some shared folders between classmates and a few encrypted archives for personal backups.

1. Dropbox asks for root 2. Dropbox does not use sandboxing (at least, the one I have doesn't) So, they do.

There's been some downvotes (thanks for the constructive feedback /s), but I'd agree that this is a better way to put it. Anything that asks for root has 100% access at that moment, and possibly in future. It's easy to forget with all the "training" that `sudo`and confirmation dialogs provide, but true. Heck, if you install something (and by install I mean allow itself to integrate into the system, as opposed to say a script), you have to trust something. Either you trust the issuer, the package maintainers, or yourself (after you've checked 100% of the source code and compile it), but there's trust at some point.

Re: How Dropbox Hacks Your Mac

#282

Post by electic »

newhouseb wrote: post #268
brentdax wrote: post #236

Earlier quoted context omitted.

> - We never see or store your admin password. The dialog box you see is a native OS X API (i.e. made by Apple). To clarify for others: In /Library/DropboxHelperTools, you'll find a folder for each user full of setuid tools which run as root and do various privileged things. I assume that the client is presenting the normal OS X "ask for elevated access" UI and then using that elevated access to configure and install…

> @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs? Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked. > This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possi…

Honestly, after the last year and a half, anything that wants root access, that is not open source, is out. Now, being open source does not make that automatically safe but it is a step in the right direction. Dropbox, MS Office, etc, are closed source tools that puts too much at stake.

Granted my team is small, but we just uninstalled dropbox today. Going to use the web interface and look for another solution in the meantime.

Re: How Dropbox Hacks Your Mac

#283

Post by norkakn »

leggomylibro wrote: post #189
entilzha wrote: post #71

Earlier quoted context omitted.

After Rice joined I actually completely stopped using Dropbox, transferred files, and deleted my account.

Ditto; now I use SpiderOak which has a solid no-knowledge replacement, but I hear Box is also good.

Box EKM is an insecure piece of shit

Re: How Dropbox Hacks Your Mac

#284

Post by 762236 »

ROFISH wrote: post #158
newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

I really wish there was some type of option to go "I really don't want all that fancy crap; give me the version that works via standard APIs"

That is the web UI.

Re: How Dropbox Hacks Your Mac

#285

Post by gwbas1c »

I work Syncplicity, a Dropbox competitor and investigated building a feature that is similar to the Dropbox badge. (We call it the App Tab. Basically, it's UI that tacks onto Office that tells you that someone else is editing the same document.)

We've had requests for this feature for years. I can't stress how much customers request this feature; it's put a lot of egg on our face that Dropbox beat us to it.

In order to do this on Mac, we'd need to register ourselves as an accessibility client. I don't remember the details about registering ourselves, but from what I remember, it doesn't require hacking into OSX.

We've had to hack into OSX in the past: Adding menu items and icons to Windows Explorer is supported via well-documented Microsoft APIs. It wasn't until about 2014 that Apple supported this, prior to that, we had to reverse-engineer Finder. We didn't get OSX APIs to do this until we hired a contractor with "connections" to Apple he petitioned his connections to provide an API. I know that Dropbox, Google Drive, Box, and an open-source project called Liferay-Nativity all performed the same hack.

Based on my Syncplicity experience is that, what happens in these cases, is that a product manager gets so focused on the pixels that he/she is completely blind to the practical implementations. There's probably a bit of "I told you so" coming from some of Dropbox's engineers now.

Re: How Dropbox Hacks Your Mac

#287

Post by godzillabrennus »

electic wrote: post #282
newhouseb wrote: post #268

Earlier quoted context omitted.

> @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs? Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked. > This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possi…

Honestly, after the last year and a half, anything that wants root access, that is not open source, is out. Now, being open source does not make that automatically safe but it is a step in the right direction. Dropbox, MS Office, etc, are closed source tools that puts too much at stake. Granted my team is small, but we just uninstalled dropbox today. Going to use the web interface and look for another solution in the…

Mac OS X is a mostly closed source operating system so I don't understand why you are drawing the line with third parties.

Re: How Dropbox Hacks Your Mac

#288

Post by Gorbzel »

ThomPete wrote: post #193

Dropbox trying to find ways to push the platform is a good thing not a bad thing. If anything Apple have put so many restrictions on OSX and isn't pushing for much innovation on their side to allow people to build ever more powerful apps. I understand general security concerns but I don't understand the critique of a company like Dropbox. They are doing the user er service not a disservice by finding a balance betwee…

Dropbox is using cached root privs that it now claims it doesn't even need to force itself into full control of your machine, on the back of an accessibility exploit, actively disregards explicit user actions taken to remove it, does this all via SQL injection, and if all of the above doesn't meet the definition of malware, I don't know what does.

All this from a company who recently had one of the largest credential breaches in the history of the Internet

and you think it's okay to "push the platform"?!???!

It's pretty popular these days to say "Delete your account" online. If this wasn't an accidental knee jerk response, please go one step farther and delete any professional involvement you have with software or technology implementation. You don't understand security concerns, nor does your poorly rehashed half-argument about OS X explain why this would be okay on any platform.

A bit emphatic, but if those goes to the greys, so be it. HN is clearly frequented by people with meaningful input in business, product, and engineering decisions. This kind of scapegoat deflection needs to be highlighted as an unacceptable security practice not justified by anything that seems to qualify as entrepreneurial disruption.

Re: How Dropbox Hacks Your Mac

#290

Post by jkmcf »

electic wrote: post #282
newhouseb wrote: post #268

Earlier quoted context omitted.

> @newhouseb, I don't have Office, so I've turned off the badge. Is Dropbox now going to leave my accessibility permissions the way I set them? Or is it going to reactivate a permission behind my back that it no longer even needs? Yep, we’re going to fix this so that if you uncheck it, we leave it unchecked. > This fiasco has probably made it more likely that Apple will further lock down the accessibility APIs, possi…

Honestly, after the last year and a half, anything that wants root access, that is not open source, is out. Now, being open source does not make that automatically safe but it is a step in the right direction. Dropbox, MS Office, etc, are closed source tools that puts too much at stake. Granted my team is small, but we just uninstalled dropbox today. Going to use the web interface and look for another solution in the…

I'd love to hear what you find. My research has shown that Dropbox is mostly the only sync service supported in mobile apps. iCloud is next. After that it's very rare to see any other integration.

I'd love to see Box or someone else encourage popular apps to support their sync platforms, but I doubt it will happen. I blame Apple for not supporting easy 3rd party integrations.

Post reply on HN