Dropship — successor to torrents?

Post by herbatnic » Mon, Apr 25, 2011, 4:31 PM UTC

limmeau wrote: post #36

limmeau wrote: post #20

Earlier quoted context omitted.

As far as I understand the original posting, you can download any file from Dropbox's servers if you know its Dropbox hash, which apparently is a sequence of SHA256 hashes of 4MB blocks. If you have a sub-4MB sensitive file, and you publish its SHA256, and the Dropbox protocol applies the hash function in the same way as file hashing tools (e.g. doesn't include a tag meaning "this hash is computed particularly for Dr…

Just read the reappeared sourcecode (assuming it works as advertised): The hash is an SHA256 of pure 4MB blocks in the input file. They add no message type information which could prevent mixups between Dropbox-deduplication hashes and hashes computed for other purposes. The following dropship file was assembled using only shasum, ls and vi: {"blocks": ["f3f754a5dcd93f271ad013a5ee84f495a36da84f152e0a1fec4646345b0c10d…

Post by [deleted] » Mon, Apr 25, 2011, 9:07 PM UTC

dbuxton wrote: post #10

schrototo wrote: post #3

This isn't even remotely similar to bittorrent, it's more akin to rapidshare et al. You're completely at the whim of a 3rd party, Dropbox. And I'm pretty sure something like this would violate whatever contract you agree to when signing up. So no, not a successor to torrents.

I'm pretty sure I've seen stuff suggesting that Dropbox occasionally purges copyrighted files from its system (which is made super-easy by the hash fingerprinting system that it uses to deduplicate storage) so I agree that this is not likely to meet most people's use case for torrents; i.e. stealing copyrighted music and films. I wonder why the github repo has been taken down.

Post by power78 » Mon, Apr 25, 2011, 9:13 PM UTC

orofino wrote: post #29

forgive what is possibly a very ignorant question, but are there security concerns here? I understand that the key space is immensely huge and that for any file over 4MB in size it would be virtually impossible to guess, but what is to stop someone from just trying hashes for fun to see if they get interesting files? Like I said for file over 4MB it seems fine, guessing sequential hashes would be all but impossible.…

Post by valindar » Tue, Apr 26, 2011, 7:52 AM UTC

power78 wrote: post #65

orofino wrote: post #29

forgive what is possibly a very ignorant question, but are there security concerns here? I understand that the key space is immensely huge and that for any file over 4MB in size it would be virtually impossible to guess, but what is to stop someone from just trying hashes for fun to see if they get interesting files? Like I said for file over 4MB it seems fine, guessing sequential hashes would be all but impossible.…

I see your point here. I hope non-public files are protected from Dropbox's deduplication

Post by gbraad » Tue, Apr 26, 2011, 1:50 PM UTC