Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Lack of Security

tirania.org

Post reply on HN
Print view View original

141–150 of 193 posts

Re: Dropbox Lack of Security

#141

Post by sunchild »

ay wrote: post #123
mixmax wrote: post #112

Earlier quoted context omitted.

I think you're missing the point. On their website it says " Dropbox employees aren't able to access user files, and when troubleshooting an account they only have access to file metadata (filenames, file sizes, etc., not the file contents) " and in their terms of service they say that they will turn over files to a government agency if subpoenaed. The problem isn't security theater, it's the fact that both of the ab…

I would be cautious in making the conclusions. Technically, it's quite trivial to implement precisely what you say is impossible. How: give the private key of an RSA keypair to US Govt; use the public key of that keypair on the clientside to encrypt the key that is used for the symmetric encryption of the contents of the file. The employee on the other end will be able to see the metadata, but he will not be able to…

It could be even simpler: Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed.

When I started my own law practice, my partners insisted that "everything must be encrypted" so that no third parties would have access to see any files. I had a feeling my partners were parroting this requirement and didn't really understand how security works. I tried to explain the pros and cons of this approach, but my warnings fell on deaf ears; the requirement was absolutely total encryption of all file data so that no third party could even theoretically peek at our data.

So, I set up JungleDisk backups to S3 with a key that only I knew about. This was an awesome solution that cost a few bucks per user per month.

Not long afterward, one of my partners insisted on having his home PC and his laptop synced. At the time, JungleDisk didn't offer syncing.

Sure enough, a few weeks later, I find out that the same guy who insisted I encrypt everything was secretly using Dropbox to sync his files. (I won't even get into the fact that he was backing up his sync folder to my JD solution!)

In summary, idiots are idiots, and security is often misunderstood.

By the way, I'm no longer working with people who fail to understand security, and we've got what I suspect are the most innovative, cost-effective and secure backups at any law firm in the world.

Re: Dropbox Lack of Security

#142

Post by grandalf »

All US companies will comply with government requests for data, even Google, when a warrant is presented.

If you don't want anyone looking at your data, use your own strong encryption layer and hope that there's not a back door.

Re: Dropbox Lack of Security

#143

Post by beehc »

patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

Why all the argument? Why not just provide encryption that would make it so that all files are encrypted and decrypted so that all users' files are completely protected?

Re: Dropbox Lack of Security

#144

Post by T-hawk »

StavrosK wrote: post #120
patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

As others said, #1 is false. You can look at your data whenever you want without letting others do the same, even if they have access to the data. That's what asymmetric (or even symmetric) cryptography does. Apart from that, did anyone ever think Dropbox was completely secure? The mere fact that they perform deduplication, which is not possible if they can't read your data, should have tipped people off to it. Not t…

> The mere fact that they perform deduplication, which is not possible if they can't read your data

It is possible because it's client-server. When a new file appears in the Dropbox folder, the Dropbox client calculates a hash of it and checks if that hash already exists with Dropbox's server-side storage. If not, then the file is uploaded and stored encrypted. You do have to trust that the Dropbox client is actually doing what it claims to do, that it isn't uploading with no or trivial encryption (like an xor or something.)

Re: Dropbox Lack of Security

#145

Post by StavrosK »

T-hawk wrote: post #144
StavrosK wrote: post #120

Earlier quoted context omitted.

As others said, #1 is false. You can look at your data whenever you want without letting others do the same, even if they have access to the data. That's what asymmetric (or even symmetric) cryptography does. Apart from that, did anyone ever think Dropbox was completely secure? The mere fact that they perform deduplication, which is not possible if they can't read your data, should have tipped people off to it. Not t…

> The mere fact that they perform deduplication, which is not possible if they can't read your data It is possible because it's client-server. When a new file appears in the Dropbox folder, the Dropbox client calculates a hash of it and checks if that hash already exists with Dropbox's server-side storage. If not, then the file is uploaded and stored encrypted. You do have to trust that the Dropbox client is actually…

And what happens when the file that matches the hash isn't yours?

Re: Dropbox Lack of Security

#146

Post by merijnv »

zdw wrote: post #140
kalleboo wrote: post #108

Earlier quoted context omitted.

It's just as easy to de-authorize devices (and hence invalidate host IDs) on Dropbox as is is to change your Facebook password.

If you dupe someone's Dropbox host ID, they'll only see the one entry on their page, so it's quite likely they would not be aware that they've been "duped".

To dupe the key they would need access to your system, though. At which point they would also have access to all your files anyway.

Now, if you fix your system to no longer be vulnerable the duped key will allow them to keep snooping your files, but personally I think this risk is marginal.

Re: Dropbox Lack of Security

#147

Post by mentat »

sunchild wrote: post #141
ay wrote: post #123

Earlier quoted context omitted.

I would be cautious in making the conclusions. Technically, it's quite trivial to implement precisely what you say is impossible. How: give the private key of an RSA keypair to US Govt; use the public key of that keypair on the clientside to encrypt the key that is used for the symmetric encryption of the contents of the file. The employee on the other end will be able to see the metadata, but he will not be able to…

It could be even simpler: Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed. When I started my own law practice, my partners insisted that "everything must be encrypted" so that no third parties would have access to see any files. I had a feeling my partners were parroting this requirement and didn't really understand how security works. I tried to explain the pros…

"Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed"

This is not the same as "is not accessible to employees". Interfaces are just that. There are quite a few very sharp developers at Dropbox if reputations are to be believed. I don't think an interface is a sufficient control.

Re: Dropbox Lack of Security

#148

Post by rakkhi »

arashf wrote: post #82
itistoday wrote: post #42

Earlier quoted context omitted.

Everything on your website that in any way addresses "Dropbox's security" should make absolutely clear the extent to which users can expect their data to be "secure". In Dropbox's case, users can expect the following: - Data is probably secure from sniffers That's it. It matters little whether "Drew has physical access to our storage servers anymore". Your code obviously has easy access to the keys used to encrypt an…

you're right in that all these things are theoretically possible in a system where the encryption key is not stored client-side. I don't know of many services that advertise every way in which their systems could be compromised. I think you'd be hard pressed to find a company doing this. in the case of google - is there a document explaining all the places your email could end up? we believe that what we advertise is…

Arash good security is about mitigating theoretical risks before they become actual.

I am most disappointed in Dropbox because you had made statements like all our data is AES encrypted and our staff do not have access to your data. These are clearly incomplete for the former and are plainly not true for the latter. They are misleading and un-ethical in that they have assisted you in gaining you all these customers. As stated above you should clearly stop using security as selling point and only state you provide security in transit (https) or actually put in place technical measures to make those statements true.

Personally I will no longer be recommending Dropbox and will instead recommend your competitors including changing my answers on Quora: http://www.quora.com/Dropbox?q=dropbox

Re: Dropbox Lack of Security

#149

Post by w1ntermute »

shin_lao wrote: post #54
kwis wrote: post #46

Earlier quoted context omitted.

Tarsnap provides exactly the sort of service you're referring to, where they only store encrypted data and don't have a copy of the key. I'm a big fan of that architecture, if only because it greatly reduces the payoff of a successful attack. When everything is stored unencrypted (or with a common master key), there's an absolutely massive payoff for the hacker who breaches the security.

Tarsnap is great and its author knows what he's doing but dropbox is many UA ahead in terms of useability and platform interoperability. Dropbox is incredibly easy to use, that's where its power comes from. It's "secure enough" for casual use. Additionally I believe you can't share data between users with tarsnap. There is a market opportunity for a corporate-level secure data exchange infrastructure.

> dropbox is many UA ahead in terms of useability and platform interoperability

That's besides the point. Tarsnap is more than useable enough for its target audience, which is why cperciva (rightfully) doesn't give a rat's ass about making it as user-friendly as Dropbox and its ilk.

The two issues are completely separate. Implementation of client-side encryption and user-friendliness are not mutually exclusive. Tarsnap is simply proof that client-side encryption is entirely within the realm of possibility for cloud-based data storage services.

Re: Dropbox Lack of Security

#150

Post by mnutt »

tlrobinson wrote: post #88
Groxx wrote: post #78

Earlier quoted context omitted.

Have fun decrypting AES in Javascript, and downloading the file through your browser. (edit: on your cell phone...)

Hint: downloading client-side generated files is not possible without assistance from Flash.

Downloading client-side generated files is possible using data-uri. However these are usually small; it would be very difficult to store a 1GB file in memory (in javascript) while you decrypted it and I doubt data-uris that large work across different browsers.
Post reply on HN