Now anyone, not just cops with a warrant, can peek inside your Dropbox
1–10 of 15 posts
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#2Linkbait. Dropbox has already said they'll "cooperate with United States law enforcement when it receives valid legal process..." That's nothing new.
Dropbox Reader doesn't allow you to read other people's accounts. You can only view an account's details (read: not the file contents) if you already have access to the computer. If LE snatches your computer and the hard drive is encrypted with a good password and algo, LE can't do anything.
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#3Linkbait. Dropbox has already said they'll "cooperate with United States law enforcement when it receives valid legal process..." That's nothing new. Dropbox Reader doesn't allow you to read other people's accounts. You can only view an account's details (read: not the file contents) if you already have access to the computer . If LE snatches your computer and the hard drive is encrypted with a good password and algo…
More than linkbait...deliberately harmful.
I'm not much of a security guru, but this seems like it lacks data and instead uses scare tactics to attack Dropbox. From the looks of it, DB isn't letting anyone do anything - it's only if you give up local access.
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#4Linkbait and false. The new tool lets anyone look at the contents of the dropbox metainformation ON THE LOCAL COMPUTER. In other words, they can programmatically access information about files already on the computer.
As for cooperating with law enforcement, that's more or less part of how warrants work. It would be illegal to say "no" to a warrant.
Disclosure: I work for Dropbox.
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#5Linkbait and false. The new tool lets anyone look at the contents of the dropbox metainformation ON THE LOCAL COMPUTER. In other words, they can programmatically access information about files already on the computer. As for cooperating with law enforcement, that's more or less part of how warrants work. It would be illegal to say "no" to a warrant. Disclosure: I work for Dropbox.
Well, if you actually encrypted data in a form that only the user could decrypt before uploading it to the server, you could simply hand that over to law enforcement in good faith and they wouldn't be able to do anything. I am a Dropbox user but I never put sensitive data on it without encrypting it.
edit: Really? Downvoted for stating an obvious fact? I mean sure, Dropbox is great, but throwing your hands up and saying "that's ... how warrants work" is disingenuous when there are perfectly legal and workable ways around that. Sure, the UX might not be quite as good, but UX compromises are often made for security's sake. (See Firefox Sync's setup for example.)
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#6Linkbait and false. The new tool lets anyone look at the contents of the dropbox metainformation ON THE LOCAL COMPUTER. In other words, they can programmatically access information about files already on the computer. As for cooperating with law enforcement, that's more or less part of how warrants work. It would be illegal to say "no" to a warrant. Disclosure: I work for Dropbox.
Well, if you actually encrypted data in a form that only the user could decrypt before uploading it to the server, you could simply hand that over to law enforcement in good faith and they wouldn't be able to do anything. I am a Dropbox user but I never put sensitive data on it without encrypting it. edit: Really? Downvoted for stating an obvious fact? I mean sure, Dropbox is great, but throwing your hands up and say…
It would be cool if DropBox exposed some sort of file stream API that would let you manipulate file data as it's sent to the server. This could be used for encryption and possibly other activities as well (automatic downsampling of MP3s to save space on your DropBox, or just generic compression on the file stream; conversion of certain OS-specific file formats to something more genericly readable if you have a multi-OS environment using the same DropBox).
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#7Linkbait and false. The new tool lets anyone look at the contents of the dropbox metainformation ON THE LOCAL COMPUTER. In other words, they can programmatically access information about files already on the computer. As for cooperating with law enforcement, that's more or less part of how warrants work. It would be illegal to say "no" to a warrant. Disclosure: I work for Dropbox.
Well, if you actually encrypted data in a form that only the user could decrypt before uploading it to the server, you could simply hand that over to law enforcement in good faith and they wouldn't be able to do anything. I am a Dropbox user but I never put sensitive data on it without encrypting it. edit: Really? Downvoted for stating an obvious fact? I mean sure, Dropbox is great, but throwing your hands up and say…
Agreed. I AES-encrypt information that's actually private on my Dropbox. But Dropbox is providing a service grounded in simplicity. Sorry, that's the product angle. And exchanging this key without Dropbox intermediating would be much more complex than what Dropbox does now.
Also, the web interface, sharing, public folders, perhaps iPhone and Android apps (you have the question of how to get the key TO the device), would not be possible with such a system, at least not anything approaching usability.
And the added complexity is not beneficial for the average case. For the exceptions, Dropbox works great with TrueCrypt or OpenSSL or GPG or whatnot encryption.
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#8Earlier quoted context omitted.
Well, if you actually encrypted data in a form that only the user could decrypt before uploading it to the server, you could simply hand that over to law enforcement in good faith and they wouldn't be able to do anything. I am a Dropbox user but I never put sensitive data on it without encrypting it. edit: Really? Downvoted for stating an obvious fact? I mean sure, Dropbox is great, but throwing your hands up and say…
Agreed. I AES-encrypt information that's actually private on my Dropbox. But Dropbox is providing a service grounded in simplicity. Sorry, that's the product angle. And exchanging this key without Dropbox intermediating would be much more complex than what Dropbox does now. Also, the web interface, sharing, public folders, perhaps iPhone and Android apps (you have the question of how to get the key TO the device), wo…
> Agreed. I AES-encrypt information that's actually private on my Dropbox. But Dropbox is providing a service grounded in simplicity. Sorry, that's the product angle. And exchanging this key without Dropbox intermediating would be much more complex than what Dropbox does now.
A bit more complex, but not much more complex. See Firefox Sync's setup screen for a great execution of strong secret shared over weak password. We've known about EKE for close to 20 years.
> Also, the web interface
Yes, agreed. I'm not convinced it's worth it though.
> sharing, public folders
Yeah, these are a little more complicated. I wonder if some sort of shared secret system could work out here.
> perhaps iPhone and Android apps (you have the question of how to get the key TO the device)
Again, see Firefox Sync.
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#9FYI: Cops haven't needed a warrant to access your electronic data for 10 years as of this fall.
There's no judicial oversight, and they do it 60,000+ times a year.
Re: Now anyone, not just cops with a warrant, can peek inside your Dropbox
#10Linkbait and false. The new tool lets anyone look at the contents of the dropbox metainformation ON THE LOCAL COMPUTER. In other words, they can programmatically access information about files already on the computer. As for cooperating with law enforcement, that's more or less part of how warrants work. It would be illegal to say "no" to a warrant. Disclosure: I work for Dropbox.
What about NSLs?
Those aren't warrants. Presumably you comply with those, too, so please stop using the "W-word". Those are signed by judges, you are necessarily under US law complying with the ones that aren't, too.