Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Lack of Security

tirania.org

Post reply on HN
Print view View original

161–170 of 193 posts

Re: Dropbox Lack of Security

#161

Post by lean »

gergles wrote: post #55

I don't care. I use Dropbox because of the unparalleled feature set and ease of integration. I have my taxes stored on Dropbox, along with a lot of other sensitive information. They're in an encrypted RAR file with a line-noise passphrase, just like they would be if I were storing them anywhere (including locally -- after all, what if Mallory steals your hard drive? Or, to parrot the most common movie plot threat, wh…

>

paying Dropbox customer here, I wouldn't call the features "unparalleled". SugarSync offers more, and for slightly less: https://www.sugarsync.com/sync_comparison.html

...or so I'm assuming. I never tried it because last time I checked they require a credit card for a free trial.

Re: Dropbox Lack of Security

#162

Post by IgorPartola »

patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

No. I don't want more security theater on their side. I want to encrypt files with my own key that they'll never get access to. No security theater is necessary in that case: I know that I am the only one that has the key since I did not share it.

I spent some time looking for a service that would seamlessly facilitate me setting up a key between all my devices, and at the same time be reasonably priced. From what I can tell nobody's created such a service so far. All the tools are there, with the exception of maybe some novel way to facilitate key transfers from my desktop to my laptop to my phone.

Dropbox offers some level of security: if they leak your raw files, it'll be damn hard to unencrypt them. On the other hand, how does it prevent people who work for them from snooping on you?

The only way I found to deal with this so far, is to rent your own servers and copy the keys only when two computers are physically connected together.

Re: Dropbox Lack of Security

#163

Post by IgorPartola »

sunchild wrote: post #156
mentat wrote: post #147

Earlier quoted context omitted.

"Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed" This is not the same as "is not accessible to employees". Interfaces are just that. There are quite a few very sharp developers at Dropbox if reputations are to be believed. I don't think an interface is a sufficient control.

I fully understand your point, but those words could be interpreted either way. Only Dropbox can confirm whether it is theoretically possible for Dropbox engineers to peek at user data.

Dropbox keeps your encryption key somewhere. They say that (a) the files stored with them are encrypted and (b) you don't have the decryption key. Conclusion: they have your plain-text key. Thus it is theoretically possible. I take their statement that their employees cannot view your files as "their employees are not allowed to view your files" with some basic precautions surrounding this. However, whoever wrote the code for revealing the plain-text key to the server when you request a file should be smart enough to figure out how to fake being that server.

Re: Dropbox Lack of Security

#164

Post by tlrobinson »

mnutt wrote: post #150
tlrobinson wrote: post #88

Earlier quoted context omitted.

Hint: downloading client-side generated files is not possible without assistance from Flash.

Downloading client-side generated files is possible using data-uri. However these are usually small; it would be very difficult to store a 1GB file in memory (in javascript) while you decrypted it and I doubt data-uris that large work across different browsers.

True, but there's no way to specify the filename and extension, so in practice you have to use Flash.

Re: Dropbox Lack of Security

#165

Post by bluelu »

taken11 wrote: post #102
steve19 wrote: post #57

Earlier quoted context omitted.

Client side. If you upload a very popular 500+mb file, maybe try a popular linux distribution iso, it will sync instantly.

so has someone written a client where you just enter hashes of popular files you are interested in and get them snyced to your dropbox?

10 years ago, europeonline launched a service where your traffic downlink would be routed through a satelite connection.

They also had a service that let you predownload files from http/ftp servers and then you could request an offline broadcast from their servers to your home pc.

Instead of refetching every file again and again, they also optimized by only checking the file size + file name. So, someone came along and created a fake ftp server script, which just replied with a listing of the things you wanted to download, and they there instantly added to your account. You only had to know the filename + filesize.

Re: Dropbox Lack of Security

#166

Post by seiji »

thaumaturgy wrote: post #49
patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

That's a severe oversimplification, IMO. Just recently there was news that duplicating the host_id from the Dropbox config onto another system will immediately gain access to all of the Dropbox files associated with that host_id, without further authentication. It's not security theatre to acknowledge that the security in such a system could be improved, especially as an option for those that require it. #3 could eas…

That's a severe oversimplification

You mean patio11 used oversimplification, folksy language, and cutesy examples to make a point? Say it ain't so!

Re: Dropbox Lack of Security

#167

Post by sunchild »

IgorPartola wrote: post #163
sunchild wrote: post #156

Earlier quoted context omitted.

I fully understand your point, but those words could be interpreted either way. Only Dropbox can confirm whether it is theoretically possible for Dropbox engineers to peek at user data.

Dropbox keeps your encryption key somewhere. They say that (a) the files stored with them are encrypted and (b) you don't have the decryption key. Conclusion: they have your plain-text key. Thus it is theoretically possible. I take their statement that their employees cannot view your files as "their employees are not allowed to view your files" with some basic precautions surrounding this. However, whoever wrote the…

Right, so "...is not accessible to employees" is very misleading and arguably incorrect.

Re: Dropbox Lack of Security

#168

Post by fluidcruft »

w1ntermute wrote: post #149
shin_lao wrote: post #54

Earlier quoted context omitted.

Tarsnap is great and its author knows what he's doing but dropbox is many UA ahead in terms of useability and platform interoperability. Dropbox is incredibly easy to use, that's where its power comes from. It's "secure enough" for casual use. Additionally I believe you can't share data between users with tarsnap. There is a market opportunity for a corporate-level secure data exchange infrastructure.

> dropbox is many UA ahead in terms of useability and platform interoperability That's besides the point. Tarsnap is more than useable enough for its target audience, which is why cperciva (rightfully) doesn't give a rat's ass about making it as user-friendly as Dropbox and its ilk. The two issues are completely separate. Implementation of client-side encryption and user-friendliness are not mutually exclusive. Tarsn…

Dropbox+ecryptfs is pretty usable, too.

Re: Dropbox Lack of Security

#169

Post by bxr »

arashf wrote: post #82
itistoday wrote: post #42

Earlier quoted context omitted.

Everything on your website that in any way addresses "Dropbox's security" should make absolutely clear the extent to which users can expect their data to be "secure". In Dropbox's case, users can expect the following: - Data is probably secure from sniffers That's it. It matters little whether "Drew has physical access to our storage servers anymore". Your code obviously has easy access to the keys used to encrypt an…

you're right in that all these things are theoretically possible in a system where the encryption key is not stored client-side. I don't know of many services that advertise every way in which their systems could be compromised. I think you'd be hard pressed to find a company doing this. in the case of google - is there a document explaining all the places your email could end up? we believe that what we advertise is…

>we're not aware of anybody having been affected by these theoretical vulnerabilities. on the flip side, we have (literally) saved thousands of college kids from losing their theses

I like the idea of what your service does, but this statement just advertizes the success of one feature to back up the failings of another.

If you just want to offer file storage, just set up an http-only svn server and be done with it.

If you want to offer proper encryption, do so, or don't say that you do.

Re: Dropbox Lack of Security

#170

Post by moe »

merijnv wrote: post #146
zdw wrote: post #140

Earlier quoted context omitted.

If you dupe someone's Dropbox host ID, they'll only see the one entry on their page, so it's quite likely they would not be aware that they've been "duped".

To dupe the key they would need access to your system, though. At which point they would also have access to all your files anyway. Now, if you fix your system to no longer be vulnerable the duped key will allow them to keep snooping your files, but personally I think this risk is marginal.

I think this risk is marginal.

No, this risk is most certainly not marginal.

There is a difference between someone stealing a snapshot of your data, and someone gaining permanent, undetectable access to your data.

It's also about attack scenarios;

With an USB stick crafted for this purpose I could steal your credentials in under 10 seconds, while you're on the toilet and forgot to enable your screensaver. Locating and downloading the actual data would take much longer, planting a trojan for later would be much more difficult and unreliable.

Post reply on HN