Dropbox Lack of Security
tirania.org
Dropbox Lack of Security
1–10 of 193 posts
Re: Dropbox Lack of Security
#2Couple this with the unencrypted metadata on mobile problem: https://grepular.com/Dropbox_Mobile_Less_Secure_Than_Dropbox...
And how their "encryption" on the server side is basically a lie, as they do dedupe on data: http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-u...
I'm stunned that anyone would use them for anything for ephemeral data you wouldn't mind posting in public.
Re: Dropbox Lack of Security
#3Couple this with the unencrypted metadata on mobile problem: https://grepular.com/Dropbox_Mobile_Less_Secure_Than_Dropbox... And how their "encryption" on the server side is basically a lie, as they do dedupe on data: http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-u... I'm stunned that anyone would use them for anything for ephemeral data you wouldn't mind posting in public.
hi there,
arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. I'm not sure why you're concluding that de-duplication implies lack of encryption. the de-duplication occurs prior to encryption.
all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud.
re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage servers anymore.
for very sensitive data, there's always the option to use truecrypt (we even offer this as a recommendation in our security documentation: https://www.dropbox.com/terms#security)
Re: Dropbox Lack of Security
#4Dropbox is a good service, and I am sure file access is limited to a few employees, but I wouldn't use it for sensitive data or for a business. Any service where you do not control the encryption keys, e.g. Box.net, and myriad others will have the same issue. It's all about tradeoffs. Ultimately they can access your data. The truecrypt option may solve it for some but that means the whole archive has to be shared.
AltDrive unlimited online backup versions your files and allows you to control your encryption key. It runs on *nix, OSX, Windows, and other OSs. http://altdrive.com
Re: Dropbox Lack of Security
#5It is possible to design a Dropbox-like system with the following properties:
1. Files are stored encrypted.
2. The service provider does not have the ability to arbitrarily decrypt the files. By "arbitrarily decrypt" I mean decrypt at any time they wish. They will be able to decrypt if the owner's client is actively connected.
3. When someone uploads a file that is identical to an existing file, it initially is stored separately, but in most cases can be eventually de-duplicated, without compromising #1 or #2.
I'll leave the details as a fun exercise.
Re: Dropbox Lack of Security
#6truecrypt ftw
If you're uncomfortable with dropbox, put a truecrypt partition right inside your dropbox folder.
Re: Dropbox Lack of Security
#7Couple this with the unencrypted metadata on mobile problem: https://grepular.com/Dropbox_Mobile_Less_Secure_Than_Dropbox... And how their "encryption" on the server side is basically a lie, as they do dedupe on data: http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-u... I'm stunned that anyone would use them for anything for ephemeral data you wouldn't mind posting in public.
hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. I'm not sure why you're concluding that de-duplication implies lack of encryption. the de-duplication occurs prior to encryption. all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud. re. employee access to f…
esteemed mr. arash, perhaps it might be a good idea for someone within dropbox to write a blog post answering common security-related concerns.
having a security sub-section in TOS is great, but it might be buried in google searches. anyways, it seems like this is a common concern amongst bloggers as you guys are exponentially rising in popularity, so some good PR on that front might be needed.
as usual, we're all rooting for you :)
Re: Dropbox Lack of Security
#8hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend.
all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud.
re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage servers anymore.
for very sensitive data, there's always the option to use truecrypt (we even offer this as a recommendation in our security documentation: https://www.dropbox.com/terms#security)
Re: Dropbox Lack of Security
#9hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud. re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage serve…
What about allowing government access to files? Do you require a warrant?
Under what circumstances?
Re: Dropbox Lack of Security
#10Do a lot of people think that Dropbox is some sort of super-private service?
I'm no security expert, but do I hope it's obvious to most people that Dropbox wouldn't be able to do stuff like reset your password if they didn't have access to the contents of your files at some level. A truly secure and private service would look a lot different, and be much more complicated to set up. That's the tradeoff.