Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Lack of Security

tirania.org

Post reply on HN
Print view View original

121–130 of 193 posts

Re: Dropbox Lack of Security

#121

Post by csallen »

Dropbox didn't lie. This is simply a misinterpretation (or misunderstanding) of what's meant by the phrase "Dropbox employees aren't able to access user files". It's not the same as saying "It's impossible." The fact is, if you send a company your unencrypted data, it's obviously possible for them to view it at some point. Otherwise they could never encrypt it in the first place. So when they say that employees aren't able to access it, they mean that they, as a company, choose not to access it.

A good analogy is the post office. Anyone who works there and handles your mail could, if they so desired, tear open your package and steal the cookies your mother sent you. We trust them anyway, because we know they take precautions to ensure it doesn't happen. Dropbox is the same, but even tougher (I doubt the average Dropbox employee has access to their decryption mechanisms, but plenty of people at the post office can unseal your envelopes).

That said, to not acknowledge it as even possible for the company you send your data to you be able to access that data seems, to me, a bit naive. That's not the promise they made, and so the claim that they lied is false.

Re: Dropbox Lack of Security

#122

Post by pieter »

whatusername wrote: post #119
pieter wrote: post #107

Earlier quoted context omitted.

There's still a big problem with de-duplication: Dropbox can still figure out which users have the same file, thus leaking information. That, combined with the fact that they'll know the size of the file already gives them a lot of info. For example, if the FBI seizes a computer and finds some illegal files, they can still request Dropbox to give a list of users that have the same file.

As has been mentioned elsewhere in the thread -- de-dupe isn't responsible. If Dropbox is storing your files -- then the TLA can always request Dropbox to give a list of users that have the same file. (Unless you have some form of independant crypto/hashing)

yes, thank you for rewording my comment.

Re: Dropbox Lack of Security

#123

Post by ay »

mixmax wrote: post #112
patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

I think you're missing the point. On their website it says " Dropbox employees aren't able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents) " and in their terms of service they say that they will turn over files to a government agency if subpoenaed. The problem isn't security theater, it's the fact that both of the ab…

I would be cautious in making the conclusions. Technically, it's quite trivial to implement precisely what you say is impossible.

How: give the private key of an RSA keypair to US Govt; use the public key of that keypair on the clientside to encrypt the key that is used for the symmetric encryption of the contents of the file.

The employee on the other end will be able to see the metadata, but he will not be able to access the contents.

The authorized government agent, on the other hand, would be able to read the file - he will have to subpoena dropbox to get the encrypted file data, and RSA-encrypted bulk encryption key, which they decrypt on their side.

What do you think ?

(As for my 2 cents on the story - someone claiming to be concerned with security who is not performing their own encryption of the data using the standard algorithms, tools and processes needs to rethink how concerned they are really).

Re: Dropbox Lack of Security

#124

Post by latch »

donpark wrote: post #53

Three points: 1. Sensationalism aside, Dropbox should review questionable security claims to reduce false sense of security if any. With millions of users, careless words formed out of marketing needs are no longer needed. What Dropbox users need now is more clear picture of what they are giving up to gain Dropbox's services. 2. The weakest security link is the user and their computer, not Dropbox which has enough fi…

Agreed. Except a lot of companies have a lot of " financial incentives at stake to be diligent security wise" but aren't.

Something I very recently heard: "World of Warcraft has had RSA-style two-factor token authentication for years, and my bank still doesn't"

Re: Dropbox Lack of Security

#125

Post by jap_mac »

patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

Ultimately it all boils down to admin's or developer's conscience. If he wants to check the data out, he will.

Re: Dropbox Lack of Security

#126

Post by gphil »

ay wrote: post #123
mixmax wrote: post #112

Earlier quoted context omitted.

I think you're missing the point. On their website it says " Dropbox employees aren't able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents) " and in their terms of service they say that they will turn over files to a government agency if subpoenaed. The problem isn't security theater, it's the fact that both of the ab…

I would be cautious in making the conclusions. Technically, it's quite trivial to implement precisely what you say is impossible. How: give the private key of an RSA keypair to US Govt; use the public key of that keypair on the clientside to encrypt the key that is used for the symmetric encryption of the contents of the file. The employee on the other end will be able to see the metadata, but he will not be able to…

Yes, I think this is exactly right. The key can be in some sort of 'escrow' where it is not accessible to DropBox employees, but accessible to the government upon subpoena.

Re: Dropbox Lack of Security

#127

Post by bxr »

thought_alarm wrote: post #10

Do a lot of people think that Dropbox is some sort of super-private service? I'm no security expert, but do I hope it's obvious to most people that Dropbox wouldn't be able to do stuff like reset your password if they didn't have access to the contents of your files at some level. A truly secure and private service would look a lot different, and be much more complicated to set up. That's the tradeoff.

>I hope it's obvious to most people that Dropbox wouldn't be able to do stuff like reset your password if they didn't have access to the contents of your files at some level

Those are pretty damn high hopes even for the average user from the generation that grew up with computers.

Re: Dropbox Lack of Security

#128

Post by halostatue »

caf wrote: post #117
arashf wrote: post #82

Earlier quoted context omitted.

you're right in that all these things are theoretically possible in a system where the encryption key is not stored client-side. I don't know of many services that advertise every way in which their systems could be compromised. I think you'd be hard pressed to find a company doing this. in the case of google - is there a document explaining all the places your email could end up? we believe that what we advertise is…

The point is that these are the kinds of claims you should be making in the marketing. Users are smart enough to understand "We are vigilant about making sure that user data is never compromised". You shouldn't be trying to bamboozle them with official-sounding acronyms like AES - that when it comes down to it, mean little.

There are classes of users who will consider it snake oil if well-known encryption algorithm names aren't used, because it implies home-grown encryption.

Re: Dropbox Lack of Security

#129

Post by randombit »

shin_lao wrote: post #54
kwis wrote: post #46

Earlier quoted context omitted.

Tarsnap provides exactly the sort of service you're referring to, where they only store encrypted data and don't have a copy of the key. I'm a big fan of that architecture, if only because it greatly reduces the payoff of a successful attack. When everything is stored unencrypted (or with a common master key), there's an absolutely massive payoff for the hacker who breaches the security.

Tarsnap is great and its author knows what he's doing but dropbox is many UA ahead in terms of useability and platform interoperability. Dropbox is incredibly easy to use, that's where its power comes from. It's "secure enough" for casual use. Additionally I believe you can't share data between users with tarsnap. There is a market opportunity for a corporate-level secure data exchange infrastructure.

Tahoe-LAFS provides a storage service that is encrypted by the client, but the original uploader of the data is still able to delegate read-only or read-write access to others on a per-file or per-directory basis.

The overall design, including how it is possible to do secure delegation, is fairly well described in a paper from the 'Storage Security and Survivability 2008' workshop - http://tahoe-lafs.org/~zooko/lafs.pdf

Post reply on HN