Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Lack of Security

tirania.org

Post reply on HN
Print view View original

41–50 of 193 posts

Re: Dropbox Lack of Security

#41

Post by arashf »

bradgessler wrote: post #37
arashf wrote: post #20

Earlier quoted context omitted.

we take as firm as stance as possible on user privacy (google faces and fights these very issues) the government needs to comply with the provisions of the electronic communications privacy act by obtaining a warrant supported by probable cause (or in some cases a court order from a judge). these safeguards protect user privacy, even when the government is involved.

Assuming you store files as a combination of a hash digest function as a key and file data as a value; what controls do you have in place to handle situations where law enforcement discovers some sort of 'illegal' file data on one users account subsequently requests details on users with hash digests that match the data in that file?

de-duplication doesn't make users any more vulnerable to intrusive government actions. today, a government agency could ask any online service to provide the names of all users who have a particular file, whether or not the service employs de-duplication. and in that case, the government would also need to support its request with a warrant or court order. the rules that provide a check against unwarranted government snooping apply to online services equally, regardless of their backend architecture.

Re: Dropbox Lack of Security

#42

Post by itistoday »

arashf wrote: post #8

hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud. re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage serve…

Everything on your website that in any way addresses "Dropbox's security" should make absolutely clear the extent to which users can expect their data to be "secure".

In Dropbox's case, users can expect the following:

  - Data is probably secure from sniffers
That's it.

It matters little whether "Drew has physical access to our storage servers anymore". Your code obviously has easy access to the keys used to encrypt and decrypt the data. This means all of the following scenarios are possible:

  - User's data is obtained via the government (users 
    aren't necessarily even informed about this)
  - User's data is obtained by rouge employee (potentially
    leaking to _anyone_ or _anything_)
  - User's data is obtained by hacker (again, implies ZERO 
    assurance of data security).
So don't flash around "AES this or that" without making it absolutely clear to the average user that what you are doing is the equivalent of storing their data in a shed guarded by a lock that can be accessed by anyone who can find (or demand) the key that you've hidden under a rock somewhere.

Re: Dropbox Lack of Security

#43

Post by bdhe »

tlrobinson wrote: post #14

It always seemed obvious to me that Dropbox has access to your unencrypted files because they make them available to you through the web interface .

> because they make them available to you through the web interface.

You could have client side javascript that decrypts the files. http://crypto.stanford.edu/sjcl/

Re: Dropbox Lack of Security

#44

Post by tlrobinson »

bdhe wrote: post #43
tlrobinson wrote: post #14

It always seemed obvious to me that Dropbox has access to your unencrypted files because they make them available to you through the web interface .

> because they make them available to you through the web interface. You could have client side javascript that decrypts the files. http://crypto.stanford.edu/sjcl/

And where would the decryption keys come from?

Re: Dropbox Lack of Security

#45

Post by [deleted] »

bradgessler wrote: post #40
jackowayed wrote: post #33

Earlier quoted context omitted.

Someone in an Amazon datacenter that gets ahold of a random backup tape/hard drive can't read it. I'm not sure if Dropbox is hosted on EC2, but if not, it means that Amazon couldn't read the data at all. (If it's hosted on EC2, Amazon could probably get ahold of the key if they really wanted to)

Going off of that assumption, what if the decryption keys were also stored in an Amazon data center? It is then possible for Amazon read the contents of these files. I'd like to hear from Dropbox how this works instead of speculation.

[deleted]

Re: Dropbox Lack of Security

#46

Post by kwis »

shin_lao wrote: post #38
patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

I might have misunderstood what you meant, but #1 is invalid. If I can look at my data any time I want, I just need the key to it. Dropbox just gives me access to the encrypted stream. Giving access to my data to someone else would therefore just be a question of sharing the key with that person, again, without Dropbox ever having access to this key. Your killer argument is to me #3. If you don't trust a company, don…

Tarsnap provides exactly the sort of service you're referring to, where they only store encrypted data and don't have a copy of the key.

I'm a big fan of that architecture, if only because it greatly reduces the payoff of a successful attack. When everything is stored unencrypted (or with a common master key), there's an absolutely massive payoff for the hacker who breaches the security.

Re: Dropbox Lack of Security

#47

Post by ethankaminski »

arashf wrote: post #8

hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud. re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage serve…

Wait, Truecrypt? Haven't I seen warnings in the Truecrypt docs against keeping several copies of the same file? And doesn't Dropbox backup every little change? You might want to add a note on your security page that storing encrypted files on a service with automated backups, like Dropbox, may pose security risks.

Re: Dropbox Lack of Security

#48

Post by bradgessler »

arashf wrote: post #41
bradgessler wrote: post #37

Earlier quoted context omitted.

Assuming you store files as a combination of a hash digest function as a key and file data as a value; what controls do you have in place to handle situations where law enforcement discovers some sort of 'illegal' file data on one users account subsequently requests details on users with hash digests that match the data in that file?

de-duplication doesn't make users any more vulnerable to intrusive government actions. today, a government agency could ask any online service to provide the names of all users who have a particular file, whether or not the service employs de-duplication. and in that case, the government would also need to support its request with a warrant or court order. the rules that provide a check against unwarranted government…

To parse that, are you saying that under such a circumstance, a government agency would have to provide the names of each person they suspect have that particular file? Or could they demand the names of all users that have a particular digest of that file?

Re: Dropbox Lack of Security

#49

Post by thaumaturgy »

patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

That's a severe oversimplification, IMO. Just recently there was news that duplicating the host_id from the Dropbox config onto another system will immediately gain access to all of the Dropbox files associated with that host_id, without further authentication.

It's not security theatre to acknowledge that the security in such a system could be improved, especially as an option for those that require it.

#3 could easily be paralyzing for many businesses. There are already services (like Tarsnap) which are engineered to not require you to trust them; why should we ignore such services and limit ourselves to doing business only with those companies that we can trust implicitly?

As a specific example, I've had a client for a few years which is government funded and quite paranoid about security. However, they also need to communicate with outside contractors. I don't advise them to "trust" their ISP, the outside contractors' network, and all the other businesses in-between. I tell them that nothing sensitive leaves the building unless it's been encrypted, and that once someone else opens that file, it can no longer be considered secure in any sense.

"Trust us" is not a compelling requirement for doing business, nor can businesses limit themselves only to relying on service providers that they trust. Fortunately, the technology exists now to eliminate that requirement.

Dropbox is currently off-limits to all employees at my client.

Re: Dropbox Lack of Security

#50

Post by kennywinker »

forgive me if I'm naive, but can file hashes be spoofed in any way? I'm thinking upload a bunch of files that hash to random numbers, then download the de-duplicated original files.

could someone more knowledgable in this area tell me if this is a credible threat?

Post reply on HN