Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Lack of Security

tirania.org

Post reply on HN
Print view View original

81–90 of 193 posts

Re: Dropbox Lack of Security

#81

Post by thaumaturgy »

bdhe wrote: post #43
tlrobinson wrote: post #14

It always seemed obvious to me that Dropbox has access to your unencrypted files because they make them available to you through the web interface .

> because they make them available to you through the web interface. You could have client side javascript that decrypts the files. http://crypto.stanford.edu/sjcl/

You're getting (maybe unfairly) downvoted because the popular opinion in security is that client-side JavaScript anything is worthless in terms of security. Since it's not authenticated in any way by the browser, any successful MITM attack on a connection can feed malicious JavaScript which would request the user's key. Or, a malicious add-on in the browser could do the same. Or, possibly, an XSRF.

I'm somewhat skeptical of this because I think that such attacks can be successfully mounted against most other web-related activities. DNS poisoning and self-signed SSL would be enough to phish many people's bank login credentials, and a lot of attacks don't even go to that much trouble.

But, anyway, client-side JavaScript for security purposes is supposed to be verboten.

Re: Dropbox Lack of Security

#82

Post by arashf »

itistoday wrote: post #42
arashf wrote: post #8

hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud. re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage serve…

Everything on your website that in any way addresses "Dropbox's security" should make absolutely clear the extent to which users can expect their data to be "secure". In Dropbox's case, users can expect the following: - Data is probably secure from sniffers That's it. It matters little whether "Drew has physical access to our storage servers anymore". Your code obviously has easy access to the keys used to encrypt an…

you're right in that all these things are theoretically possible in a system where the encryption key is not stored client-side. I don't know of many services that advertise every way in which their systems could be compromised. I think you'd be hard pressed to find a company doing this. in the case of google - is there a document explaining all the places your email could end up?

we believe that what we advertise is in our userbase's best interest. in theory, we could generate a lengthy document attempting to explain every possible way dropbox could be compromised. but in practice, discussing these extremely unlikely theoretical vulnerabilities would generate undue fear. as an ironic sidenote: this thread was spawned by an attempt we made to clarify our handling of court orders (see: http://www.businessinsider.com/dropbox-updates-security-term... )

I say "undue fear" for a couple reasons. first and foremost because we are vigilant about making sure that user data is never compromised. our reputation would be permanently damaged if dropbox is compromised. we have a lot of smart, security conscious people making sure data in dropbox is safe.

we're also listening to feedback we've been hearing from the community on things we can do to improve security. a couple concrete examples: we're working on better protecting the authentication token (config.db) so that gaining access to a dropbox account on a compromised machine is much more difficult. similarly we're working on a performant way to transmit file metadata over SSL on the mobile apps.

secondly, we believe that storing data in dropbox is far more safe than the alternatives. we've designed dropbox to protect user data against threats of all kinds, but we've focused the most on helping users avoid the most common threats to their data: not having any backups at all, not having current backups, accidentally deleting files, losing hours of work, leaving files on the wrong computer, losing a USB drive with sensitive info, protecting from curious snoopers on the dorm network, etc.

for all the talk of security issues in the last few weeks, we're not aware of anybody having been affected by these theoretical vulnerabilities. on the flip side, we have (literally) saved thousands of college kids from losing their theses :-).

Re: Dropbox Lack of Security

#83

Post by nikcub »

patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

I don't think that is what he is asking for. I took that he said 'Dropbox lied on this point, why should we believe them on others'

Re: Dropbox Lack of Security

#84

Post by nikcub »

piaskal wrote: post #77
shin_lao wrote: post #72

Earlier quoted context omitted.

You can store a key escrow on the dropbox server protected by a password or a token. Just a matter of designing something secure and useable. Not easy, but possible.

When you forget your password you'll lose access to all of your data. Password recovery won't be possible if the key is password protected.

I believe most tech users understand that and accept the compromise when they are using an 'encrypted' system

Re: Dropbox Lack of Security

#85

Post by JoachimSchipper »

shin_lao wrote: post #72
palish wrote: post #60

Earlier quoted context omitted.

If the key file is stored on Dropbox servers, then Dropbox has access to all of your files. This defeats the original purpose (security). If the key file is not stored on Dropbox servers, then you can't easily use Dropbox across several different computers. This defeats the other purpose (accessibility).

You can store a key escrow on the dropbox server protected by a password or a token. Just a matter of designing something secure and useable. Not easy, but possible.

That doesn't work, Dropbox/your favourite TLA will just wait for you to supply the password and then save the key. Trading off the inconveniences of good crypto (e.g. no web interface) for that little security isn't worth it.

Re: Dropbox Lack of Security

#86

Post by JoachimSchipper »

thaumaturgy wrote: post #81
bdhe wrote: post #43

Earlier quoted context omitted.

> because they make them available to you through the web interface. You could have client side javascript that decrypts the files. http://crypto.stanford.edu/sjcl/

You're getting (maybe unfairly) downvoted because the popular opinion in security is that client-side JavaScript anything is worthless in terms of security. Since it's not authenticated in any way by the browser, any successful MITM attack on a connection can feed malicious JavaScript which would request the user's key. Or, a malicious add-on in the browser could do the same. Or, possibly, an XSRF. I'm somewhat skept…

The number of people who will find an attack in the middle of a ton of Javascript is much smaller than the number of people who properly handle a certificate warning.

Re: Dropbox Lack of Security

#87

Post by JoachimSchipper »

arashf wrote: post #82
itistoday wrote: post #42

Earlier quoted context omitted.

Everything on your website that in any way addresses "Dropbox's security" should make absolutely clear the extent to which users can expect their data to be "secure". In Dropbox's case, users can expect the following: - Data is probably secure from sniffers That's it. It matters little whether "Drew has physical access to our storage servers anymore". Your code obviously has easy access to the keys used to encrypt an…

you're right in that all these things are theoretically possible in a system where the encryption key is not stored client-side. I don't know of many services that advertise every way in which their systems could be compromised. I think you'd be hard pressed to find a company doing this. in the case of google - is there a document explaining all the places your email could end up? we believe that what we advertise is…

Really, dropbox is probably more secure than most complainers' computers; but when you say things like

    - All transmission of file data occurs over an encrypted channel (SSL).
    - All files stored on Dropbox servers are encrypted (AES-256)
and this turns out to mean "file metadata may not be encrypted" and "all files stored on Dropbox servers are encrypted with the same key (AES-256)"... well, people are going to call "snake oil".

Re: Dropbox Lack of Security

#88

Post by tlrobinson »

Groxx wrote: post #78
shin_lao wrote: post #38

Earlier quoted context omitted.

I might have misunderstood what you meant, but #1 is invalid. If I can look at my data any time I want, I just need the key to it. Dropbox just gives me access to the encrypted stream. Giving access to my data to someone else would therefore just be a question of sharing the key with that person, again, without Dropbox ever having access to this key. Your killer argument is to me #3. If you don't trust a company, don…

Have fun decrypting AES in Javascript, and downloading the file through your browser. (edit: on your cell phone...)

Hint: downloading client-side generated files is not possible without assistance from Flash.

Re: Dropbox Lack of Security

#89

Post by tlrobinson »

bdhe wrote: post #68
tlrobinson wrote: post #36

Earlier quoted context omitted.

Yes, I read that article too. That information leakage vulnerability can be eliminated by requiring the user always upload the file the first time they store it. Subsequent uploads of the same file for the same user could be skipped. De-duplication across users in storage is also possible without leaking information. What is not possible (AFAIK) is the combination of the two requirements: 1) de-duplication across use…

You can do (1) and (2) but it is not trivial to prove that it works. See: http://news.ycombinator.com/item?id=2461713

Clever. I like it.

Re: Dropbox Lack of Security

#90

Post by JoachimSchipper »

ethankaminski wrote: post #47
arashf wrote: post #8

hi there, arash from dropbox here. all data is (as we state in the referenced help article) encrypted before it's stored on the backend. all data on dropbox can be made shareable and is web viewable. as a consequence, we do need the ability to decrypt in the cloud. re. employee access to files - there are controls to prevent this. for example, even drew (founder/CEO), doesn't have physical access to our storage serve…

Wait, Truecrypt? Haven't I seen warnings in the Truecrypt docs against keeping several copies of the same file? And doesn't Dropbox backup every little change? You might want to add a note on your security page that storing encrypted files on a service with automated backups, like Dropbox, may pose security risks.

Really? That'd be amazingly broken - consider any of the append-only log-structured filesystems currently in vogue on Linux, which are very likely to preserve multiple versions of any file being stored (right?). Not to mention normal backups.
Post reply on HN