Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropship — successor to torrents?

forwardfeed.pl

Post reply on HN
Print view View original

41–50 of 74 posts

Re: Dropship — successor to torrents?

#41

Post by wladimir »

limmeau wrote: post #36
limmeau wrote: post #20

Earlier quoted context omitted.

As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks. If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dr…

Just read the reappeared sourcecode (assuming it works as advertised): The hash is an SHA256 of pure 4MB blocks in the input file. They add no message type information which could prevent mixups between Dropbox-deduplication hashes and hashes computed for other purposes. The following dropship file was assembled using only shasum, ls and vi: {"blocks": ["f3f754a5dcd93f271ad013a5ee84f495a36da84f152e0a1fec4646345b0c10d…

Yes, I've got the beach image in my Dropbox folder now :)

Re: Dropship — successor to torrents?

#43

Post by mmastrac »

0x0 wrote: post #21
limmeau wrote: post #20

Earlier quoted context omitted.

As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks. If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dr…

That's still a bit worrying though; do people stop to consider that publishing a SHA256 hash bears the risk of being equivalent of publishing the file itself (assuming someone uploads it to dropbox)? Another related attack could be to start with a known file (say, your employment contract), swap out the name with a colleague and generate a bunch of files with different salary amounts, essentially bruteforcing sha256…

Assuming you know the exact structure of the file this would be a perfectly valid attack. There could be a lot of variance in rich formats like PDF files from things like compression, etc, so this might be expensive to perform on non-plaintext files.

Dropbox effectively acts as an "existence oracle". You can't ask it to cough up a file you don't have, but you can ask it if a given file exists anywhere in the system.

This would be an effective way for law enforcement or copyright civil enforcement to check for content that is clearly illegal or a certainly copyright violation to possess. They would need to query for a set of hashes of the given illegal content. If any matches returned positive data, they would be able to issue a subpoena for all users who stored the given content in their dropbox folder and pursue them further.

Re: Dropship — successor to torrents?

#44

Post by [deleted] »

dbuxton wrote: post #10
schrototo wrote: post #3

This isn't even remotely similar to bittorrent, it's more akin to rapidshare et al. You're completely at the whim of a 3rd party, Dropbox. And I'm pretty sure something like this would violate whatever contract you agree to when signing up. So no, not a successor to torrents.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

[deleted]

Re: Dropship — successor to torrents?

#45

Post by wladimir »

scotty79 wrote: post #26
wladimir wrote: post #15

Earlier quoted context omitted.

Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data dist…

Did he give any rationale for his request?

Yes, as I kind of hinted at in my post, the main reason is that they don't want the stigma that is associated with file sharing.

Even though there is a lot of (social) legal sharing going on between users, the focus is always on illegal sharing. He has a point there, though I think it's a pity.

IMO it's not even that suited to piracy, as the deduplication means that they can find everyone that has a file! Torrents are way better for that.

The principles of dropship could be used for sharing photos, videos, public datasets, git-like source control, or even as building block for wiki-like distributed databases. The possibilities are endless when every file can be called up with just its hash.

Re: Dropship — successor to torrents?

#46

Post by p09p09p09 »

wladimir wrote: post #15
dbuxton wrote: post #10

Earlier quoted context omitted.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data dist…

I've been sending TV shows to friends privately since I started using dropbox. Never seen a takedown. As long as they don't get a dmca, I doubt they care.

If they did how hard would it be to pad media files with some salt to break hashing anyways? Not hard at all...

Re: Dropship — successor to torrents?

#47

Post by zacharypinter »

wolfparade wrote: post #30
wladimir wrote: post #15

Earlier quoted context omitted.

Arash (the CTO) asked me to, in a really civil way. So I decided to respect his wish and take down the repository. Myself, I really regarded dropship as a nice feature. As Dropbox had implemented the great idea of putting all humanity's data in one big hash-addressable vat, sharing is a logical extension. If you would cache the popular blocks locally (dropbox already does this in a way with LAN P2P), global data dist…

I think that's a very poor business choice by Arash. Third party developers need freedom.

Think of all the bandwidth charges Dropbox would be incurring if this took off. They'd have to make the service more expensive for everyone.

Re: Dropship — successor to torrents?

#48

Post by Jd »

wladimir wrote: post #45
scotty79 wrote: post #26

Earlier quoted context omitted.

Did he give any rationale for his request?

Yes, as I kind of hinted at in my post, the main reason is that they don't want the stigma that is associated with file sharing. Even though there is a lot of (social) legal sharing going on between users, the focus is always on illegal sharing. He has a point there, though I think it's a pity. IMO it's not even that suited to piracy, as the deduplication means that they can find everyone that has a file! Torrents ar…

There is a way around this. Charge the person sharing the file a certain amount of money after a certain bandwidth (rather than the person downloading the file). This would virtually prevent large scale piracy without preventing many other usages.

Re: Dropship — successor to torrents?

#49

Post by Pahalial »

antimatter15 wrote: post #31

It's a novel exploit of deduplication, but I don't see how it's practically any better than moving a file into the /Public directory and handing them a URL.

Dropbox has bandwidth limits on /Public URLs, particularly low for free accounts. This wholly circumvents that, and I suspect that's the real reason Arash asked for a takedown, not so much the loose association with piracy.

Re: Dropship — successor to torrents?

#50

Post by viraptor »

mmastrac wrote: post #43
0x0 wrote: post #21

Earlier quoted context omitted.

That's still a bit worrying though; do people stop to consider that publishing a SHA256 hash bears the risk of being equivalent of publishing the file itself (assuming someone uploads it to dropbox)? Another related attack could be to start with a known file (say, your employment contract), swap out the name with a colleague and generate a bunch of files with different salary amounts, essentially bruteforcing sha256…

Assuming you know the exact structure of the file this would be a perfectly valid attack. There could be a lot of variance in rich formats like PDF files from things like compression, etc, so this might be expensive to perform on non-plaintext files. Dropbox effectively acts as an "existence oracle". You can't ask it to cough up a file you don't have, but you can ask it if a given file exists anywhere in the system.…

> for content that is clearly illegal or a certainly copyright violation to possess

How can something be "clearly" a violation? If I have an album, but copy someone else's rip instead of making my own - is that "clearly" a violation? Alternatively if I used the same application, I'd probably obtain the exact same file - is that clearly a violation too?

(grooveshark kind of operates on the assumption that it's ok)

Post reply on HN