Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox exposes personal details of viewers of publicly shared Paper documents

twitter.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#81

Post by vonmoltke »

swebs wrote: post #39
plg wrote: post #22

Man alive, all I want is a folder that syncs. That's all. I understand that Dropbox is a business and blah blah blah ... so what are my alternatives if I literally only want: - a folder that syncs on my devices - the ability to share a folder with others - cross-platform

I've been using Nextcloud for a few years and it's great. The catch is that it's self-hosted so you'll have to get a VPS or have a Raspberry Pi lying around that you want to use for it. Setting up the server takes about 10 minutes if you're a technical user. It's just "sudo snap install Nextcloud" then some additional LetsEncrypt settings if you want SSL. I'll admit it's not a good solution for non-technical users wh…

Note that their website appears to be down at the moment. Not even "server overloaded" down, but "server not there" down.

They are on GitHub, though: https://github.com/nextcloud

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#82

Post by dual_basis »

jostmey wrote: post #49

And does anyone actually use Dropbox paper? I'd rather have a Dropbox email service and client than this silly product

I do, because they are one of the few online collaboration platforms which support LaTeX. I'm not talking about Overleaf, which is great if you want to make a full LaTeX document, I'm talking about an easier markdown editor where LaTeX is only used for math equations. I don't need the full turing-completeness of LaTeX if I'm just taking some notes during a meeting, but I do want to be able to write math formulae and have them display correctly.

This was the sole reason I checked it out, however I have grown to appreciate many of their other features. Their collaboration functionality is quite unique, and the generally smooth way you can add structured information (eg. "todos" with assigned users and due dates) is great.

That being said, it often feels "half-baked" still compared to other solutions. The Paper file organization interface feels like it is just bolted on top of Dropbox's existing interface, and sometimes their formatting is too restrictive (eg. you can't change text alignment). The issue raised in this post is yet another example of the product being half-baked.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#83

Post by dual_basis »

mlthoughts2018 wrote: post #27
AznHisoka wrote: post #20

Earlier quoted context omitted.

Dropbox to me seems like a one-trick pony trying desperately to expand their market. It's a cloud storage system. Ideally for consumers, not enterprises (who already have Google Drive, or AWS if you're storing web objects). I know they acquired HelloSign awhile back, but who the heck would want to use both DropBox and HelloSign together?

I believe their goal is to expand to enterprise customers who would use Dropbox as a replacement for something like Google Drive. They seem to hypothesize that the way to win market share is through collaboration intelligence features and coordination features. I think it’s a bad hypothesis and really if they have a way to win market share it’s purely by being a cheaper / more basic option, then maybe start-ups or sm…

Your last two sentences seem contradictory.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#84

Post by vorpalhex »

thunderbong wrote: post #42
plg wrote: post #22

Man alive, all I want is a folder that syncs. That's all. I understand that Dropbox is a business and blah blah blah ... so what are my alternatives if I literally only want: - a folder that syncs on my devices - the ability to share a folder with others - cross-platform

I'll also vouch for syncthing. It's the best file sharing application. It works cross platform, has windows, linux, android and mac clients. I can choose to share specific folders for each device. I have one set up on a DO droplet and seamlessly syncs across all my devices. Also, when two devices are on the same LAN, it discovers the devices automatically. Couldn't praise it enough! https://syncthing.net/

I use syncthing and it's fine but it's not bulletproof. Simple sync cases are fine, but when you start having permissions and both sources actively write data, it can lock up and end up in a weird state.

To its credit, you can always resolve the problems with some careful deleting and the occasional permissions kludge.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#85

Post by dual_basis »

marcinzm wrote: post #15
daniel_iversen wrote: post #6

Earlier quoted context omitted.

Why is it a GDPR breach when a Dropbox screen clearly explains to the user clicking the link that other users will see your details if you proceed? (Just curious, it may well be an issue, I just don’t know how).

GDPR, as I understand, does not allow removing unrelated features if someone does not agree to have their privacy broken. For example, opting out of ad tracking cannot make the site be blocked for me. In this case, there is no opt out button other than not using the feature and the feature does not require this information sharing.

Essentially Dropbox is arguing that, due to the way they have implemented it, the feature does require this information sharing.

While it clearly could be implemented many different ways, and I agree Dropbox should do better in this case, I think this is one of the difficulties in enforcing something like GDPR. Almost anything could be made to work in an anonymous way, so where do you draw the line? When signing up for Facebook or an email account, for example, there is no reason they need my phone number. Sure, they say it is for password reset purposes, but there are other solutions for this, or I can simply agree not to be able to reset the password for that account... etc.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#86

Post by climb_stealth »

plg wrote: post #22

Man alive, all I want is a folder that syncs. That's all. I understand that Dropbox is a business and blah blah blah ... so what are my alternatives if I literally only want: - a folder that syncs on my devices - the ability to share a folder with others - cross-platform

I'm very happy with Tresorit [0]. I used to use Spideroak but switched when their warrant canary got removed.

The big plus for me is end to end encryption. I use it for documents and scans and never felt okay having those in Dropbox.

I also have their cli client running on my Synology NAS so I get a local copy as well as in the cloud.

The only downside, it is a fair bit more pricey when you need a lot of storage.

[0] https://tresorit.com/

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#87

Post by johnisgood »

neogodless wrote: post #30
giancarlostoro wrote: post #21

Earlier quoted context omitted.

I'd be OK with just part of their email or something, or only first or last name (but never both, or switched). It should only be 1 bit of information that if it looks off it would alert someone that the link has been compromised. On the other hand I feel like Google Docs does the same thing.

I believe the way Google Docs works is that if you share something publicly, people show up as "Anonymous Animal" and that's about the limit of what you can learn about them, unless they are on the same G Suite account with you. Although I think you might have the option to "reveal your Google Account" to other users/viewers of the shared document.

> Although I think you might have the option to "reveal your Google Account" to other users/viewers of the shared document.

Is it not the default when you are logged in? It used to be the case that when you are logged in and you visit Google Docs, you (your name at the very least) show up on the list of viewers.

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#88

Post by martin_a »

kop316 wrote: post #65
martin_a wrote: post #50

Earlier quoted context omitted.

Ah, good to hear that. I still have to look into that to decouple more from Google. Do you have any good resources for more information on how to move contacts and calendar? Or did this work right from the start for you?

It was pretty out of the box friendly. You have to download all of that from google (I recall they have an export function), and it was in a file that nextcloud natively accepts.

Ah, okay. I thought I would need to move them somehow right on my phone. Will have a look into that, thanks!

Re: Dropbox exposes personal details of viewers of publicly shared Paper documents

#89

Post by johnisgood »

marcinzm wrote: post #15
daniel_iversen wrote: post #6

Earlier quoted context omitted.

Why is it a GDPR breach when a Dropbox screen clearly explains to the user clicking the link that other users will see your details if you proceed? (Just curious, it may well be an issue, I just don’t know how).

GDPR, as I understand, does not allow removing unrelated features if someone does not agree to have their privacy broken. For example, opting out of ad tracking cannot make the site be blocked for me. In this case, there is no opt out button other than not using the feature and the feature does not require this information sharing.

> opting out of ad tracking cannot make the site be blocked for me.

Does this apply to cookies? I am asking because lot of websites have "necessary" cookies and there is no way to opt out of them (other than by closing the tab), and if there is and you do, then you cannot proceed further. I really do not understand why some cookies would be necessary to view a page though, but I have seen this on A LOT of sites.

Post reply on HN