Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Dropbox Hacks Your Mac

applehelpwriter.com

Post reply on HN
Print view View original

361–370 of 435 posts

Re: How Dropbox Hacks Your Mac

#361

Post by allending »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

Office Integrations: Worthless for a huge swath of users who don't have Office. Also undesirable for a large group of users who have Office but have no use for the integration.

Other Integrations: Too vague to justify what is potentially a large security threat. You've really got to do better than that.

Re: How Dropbox Hacks Your Mac

#362

Post by arximboldi »

rocky1138 wrote: post #296
arximboldi wrote: post #267

Earlier quoted context omitted.

I use Syncthing: https://syncthing.net/ Totally distributed, works like magic. Being distributed means you do have to blindly trust a third party, but also that don't have to worry about $ per megabite. For example, one of the machines I have in my Syncthing network is a Raspberry Pi with a 3TB drive getting a backup of my laptop $HOME and important stuff from other machines all the time.

Is it a Pi 1? I tried for months to get it to work with it, but even overclocked, it was still too damn slow to function. I love Syncthing, though, but I had to take the Pi out of the pool.

Yeah, admittedly I also tried with a Pi 1 but it was too slow, now I have a Pi 3 for that.

Re: How Dropbox Hacks Your Mac

#363

Post by iomike »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

No problem. I've deleted dropbox and looking at alternatives. So far, they're cheaper for more space and don't pull this bullshit.

Re: How Dropbox Hacks Your Mac

#364

Post by elmigranto »

bahoom wrote: post #357
elmigranto wrote: post #354

Earlier quoted context omitted.

> My point is that they can't do more damage then regular applications you run on your mac. Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update. Keylogger can't steal your password, if it's in keychain, even though it knows your root password. But I guess now it'll add its…

> Well, they can autoconfirm Keychain prompts with simulated keyboard events (and access all the keychain data in general), for one. This is something non-accessibility apps can't do after some update. Simulating keyboard (and mouse) events is easily possible for non-accessibility apps (CoreGraphics CGEvent api). In fact, AXUIElementPostKeyboardEvent is just a simple wrapper around CGPostKeyboardEvent.

It is, but OS X won't accept it and will not unlock Keychain item, unless all the apps that do this are in Accessibility. So if there is an app that uses those APIs but not in Accessibility, even you yourself won't be able to copy anything password-protected from Keychain.

https://support.apple.com/en-us/HT205375

  SecurityAgent
  Available for: OS X El Capitan 10.11

  Impact: A malicious application can programmatically control keychain access prompts

  Description: A method existed for applications to create synthetic clicks on keychain prompts. This was addressed by disabling synthetic clicks for keychain access windows.

  CVE-ID
  CVE-2015-5943

Re: How Dropbox Hacks Your Mac

#365

Post by morganvachon »

bad_user wrote: post #313
morganvachon wrote: post #214

Earlier quoted context omitted.

How so? Seafile and SpiderOak both thrive on their excellent Linux support, and Mega also supports Linux with an official client. They are, if not in the top five, at least in the top ten of popular consumer cloud storage solutions.

With all due respect but this is the first time I've heard of Seafile, probably because Seafile isn't for consumers [1], SpiderOak is primarily a backup solution that learned to do sync, with its client implementations being weird, ugly and featureless and while I never tried Mega, I really don't think anybody sane can trust Kim Dotcom's Mega with any important files. As anecdote I have zero acquaintances using any o…

> With all due respect but this is the first time I've heard of...

and

> As anecdote I have zero acquaintances using any of these.

Your experience is not the same as everyone else's. Do a Google search for "cloud storage" and you'll see all the ones I mentioned coming up in lists in the first page of results. If that's not "in the top 10", I'd love to know your definition. Oh, right, you already gave it: "Well I've never heard of it!"

Re: How Dropbox Hacks Your Mac

#366

Post by kuschku »

pvdebbe wrote: post #332
kuschku wrote: post #92

Earlier quoted context omitted.

You might want to switch to katex instead - and katex can also be run on the server to return HTML directly.

KaTeX looks very good, but currently I let org-mode do the backend lifting for me. Maybe if I rewrite my blog engine once again... ;-)

At least use it on the client then – it’s a lot faster than MathJax :)

Re: How Dropbox Hacks Your Mac

#367

Post by breatheoften »

dordoka wrote: post #356
breatheoften wrote: post #333

Anybody know a good OS X app to scan the file system for suid binaries? I guess I could do this with find from the shell, but a little utility app with a nice ui (and possibily some integration with a database to hide or categorize by threat level) seems like a smart thing to have on my system and run every so often.

I wanted to do the same thing earlier today and found out this that might help. I know that you ask for a gui but just in case: http://commandlinemac.blogspot.com.es/2008/12/find-suidsgid-...

Yeah, I guess that's probably good enough. I knew I could do this but was sort of thinking it would be nice to have a little dedicated tool that filters out or separates all the "known should be suid" -- and maybe tracks changes over time ... An interface to check periodically to quickly keep abreast of what's changing ...

Re: How Dropbox Hacks Your Mac

#368

Post by ThomPete »

Gorbzel wrote: post #288
ThomPete wrote: post #193

Dropbox trying to find ways to push the platform is a good thing not a bad thing. If anything Apple have put so many restrictions on OSX and isn't pushing for much innovation on their side to allow people to build ever more powerful apps. I understand general security concerns but I don't understand the critique of a company like Dropbox. They are doing the user er service not a disservice by finding a balance betwee…

Dropbox is using cached root privs that it now claims it doesn't even need to force itself into full control of your machine, on the back of an accessibility exploit, actively disregards explicit user actions taken to remove it, does this all via SQL injection, and if all of the above doesn't meet the definition of malware, I don't know what does. All this from a company who recently had one of the largest credential…

You can't se the forrest for the trees.

Of course you can claim it's malware, but sometimes malware works FOR the user not against them this is an example of that.

If anything you should put your anger towards Apple who haven't done anything to osx platform for ages.

With regards to security I both understand it and take it very seriously but I have no interest in theoretical debates. In this specific case I have no issue with what Dropbox is doing. I have an issue that Apple haven't found a way to make these things possible without the exploit.

If you feel strongly about it, be my guest delete all your accounts. I see no reason not to trust Dropbox, but hey each to their own.

Re: How Dropbox Hacks Your Mac

#369

Post by angry_octet »

newhouseb wrote: post #121

Hi HN — Ben from Dropbox here on the desktop client team. Wanted to clarify a few things — - Clearly we need to do a better job communicating about Dropbox’s OS integration. We ask for permissions once but don’t describe what we’re doing or why. We’ll fix that. - We only ask for privileges we actively use -- but unfortunately some of the permissions aren’t as granular as we would like. - We use accessibility APIs for…

You are really just digging the hole deeper at this point. This needs a mea maxima culpa.

Apple really should kick you from the App Store and blacklist dropbox as malware.

Re: How Dropbox Hacks Your Mac

#370

Post by Vendan »

hobarrera wrote: post #359
Vendan wrote: post #295

Earlier quoted context omitted.

Hence why I put hacking in quotes...? I'm just pointing out that Dropbox is arguably jumping through hoops to get access to functionality that Windows gives to basically anything that gets a toehold on your system.

The fact that windows has even less security (though I'd like to think you exaggerated), doesn't justify this at all.

It's a basic fact of the way Windows is designed. If you can get code to run on a Windows computer, you get a lot of power over that computer. Even more if the user is a local administrator. As someone that tests Windows computer network security on a regular basis, it is rather disturbing how much work you have to put into making a Windows network actually secure.
Post reply on HN