Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropship — successor to torrents?

forwardfeed.pl

Post reply on HN
Print view View original

21–30 of 74 posts

Re: Dropship — successor to torrents?

#21

Post by 0x0 »

limmeau wrote: post #20
0x0 wrote: post #19

Earlier quoted context omitted.

Does that mean that the current protocol allows users to steal arbitrary files given a hash? For example if some web site charges per download of a file, but still has the hash posted publicly, you can try to "steal" it from someone who has it stored privately in Dropbox? IOW, the file hash is equivalent to your account login/password combo [restricted to any given file]?

As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks. If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dr…

That's still a bit worrying though; do people stop to consider that publishing a SHA256 hash bears the risk of being equivalent of publishing the file itself (assuming someone uploads it to dropbox)?

Another related attack could be to start with a known file (say, your employment contract), swap out the name with a colleague and generate a bunch of files with different salary amounts, essentially bruteforcing sha256 sums. If dropbox suddenly coughs up a file, you've revealed his salary!

Re: Dropship — successor to torrents?

#22

Post by baq »

codeflo wrote: post #16
dbuxton wrote: post #10

Earlier quoted context omitted.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Can anyone give a reference for this or indicate if it's true? I use Dropbox to backup my purchased music downloads; the thought that when my hard disk crashes, I can't restore them from my Dropbox because they might have been "purged" is rather worrying.

dropbox doesn't encrypt your data either, so it's generally not a good idea to keep any kind of your sensitive data unencrypted there.

i guess storing something like a small truecrypt volume there would be just about enough.

Re: Dropship — successor to torrents?

#23

Post by redstripe »

codeflo wrote: post #16
dbuxton wrote: post #10

Earlier quoted context omitted.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Can anyone give a reference for this or indicate if it's true? I use Dropbox to backup my purchased music downloads; the thought that when my hard disk crashes, I can't restore them from my Dropbox because they might have been "purged" is rather worrying.

If you're purchasing from iTunes, the files have your email and other personal info in them which would give them a unique hash and differentiate them from the content that was popular/being deleted.

Re: Dropship — successor to torrents?

#25

Post by llimllib »

lachyg wrote: post #4
Stuk wrote: post #2

From "How does it work?" in the Readme: Dropbox its deduplication scheme works by breaking files into blocks. Each of these blocks is hashed with the SHA256__ algorithm and represented by the digest. Only blocks that are not yet known are uploaded to the server when syncing. By using the same API as the native client, Dropship pretends to sync a file to the dropbox folder without actually having the contents. This bl…

I still don't get it. Anyone willing to explain?

I'll try.

Let's say you want to upload files A and B to Dropbox from your computer. A is a 3mb file, and B is a 12mb file.

The dropbox client first looks at A, sees that it's The client then sends that hash to the server, which checks to see if it has already seen that hash. If it has, then it assumes that it already has the file, and just copies it from the previous location where it stored the block with that hash. If it hasn't, then it goes ahead and uploads the file.

The process for uploading file B is very similar, except that the client breaks it into three 4mb blocks, hashes each of those, and sends the hash to the server to see if it's already received those blocks.

Phew. OK, now we can get to why Dropship is (was?) a neat hack. The idea is, if Alfred has uploaded file C, and Barbara wants to get a hold of file C, but doesn't want to download it, she can just send the dropbox server the hashes for each 4mb block of file C.

The server will see each hash, say "ahha! I've already got the block represented by that hash, so I won't make you upload it!", and put the file in Barbara's Dropbox.

Does that make sense?

[1]: http://en.wikipedia.org/wiki/Hash_function

[2]: Not really unique, but the idea of hash functions is that we turn each input into a "hash" which is really really really likely to be unique, so likely that we can treat it as unique.

Re: Dropship — successor to torrents?

#26

Post by scotty79 »

wladimir wrote: post #15
dbuxton wrote: post #10

Earlier quoted context omitted.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data dist…

Did he give any rationale for his request?

Re: Dropship — successor to torrents?

#28

Post by limmeau »

0x0 wrote: post #21
limmeau wrote: post #20

Earlier quoted context omitted.

As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks. If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dr…

That's still a bit worrying though; do people stop to consider that publishing a SHA256 hash bears the risk of being equivalent of publishing the file itself (assuming someone uploads it to dropbox)? Another related attack could be to start with a known file (say, your employment contract), swap out the name with a colleague and generate a bunch of files with different salary amounts, essentially bruteforcing sha256…

The employment contract scenario doesn't require download-by-hash, only deduplication. You could just measure the amount of network traffic the client needs to "upload" your file.

Re: Dropship — successor to torrents?

#29

Post by orofino »

forgive what is possibly a very ignorant question, but are there security concerns here? I understand that the key space is immensely huge and that for any file over 4MB in size it would be virtually impossible to guess, but what is to stop someone from just trying hashes for fun to see if they get interesting files?

Like I said for file over 4MB it seems fine, guessing sequential hashes would be all but impossible. I assume the realistic solution is just to encrypt my files (preferably in a truecrypt volume over 4MB in size) if I'm truly concerned.

On a side note, it would be interesting to see if this could be modified to tell me how unique my overall file set is.

Re: Dropship — successor to torrents?

#30

Post by wolfparade »

wladimir wrote: post #15
dbuxton wrote: post #10

Earlier quoted context omitted.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data dist…

I think that's a very poor business choice by Arash. Third party developers need freedom.
Post reply on HN