Dropbox opening my docs? • Hacker News Board

Re: Dropbox opening my docs?

#11

Post by madaxe » Thu, Sep 12, 2013, 4:32 PM UTC

I would wager that they're opening it in order to generate a thumb or preview, or maybe for search indexing, and libreoffice is a good way to achieve this on linux - particularly if they're only opening it once, as they probably use the hash of the file.

We do exactly this on our eCommerce platform, before wanging stuff into s3 or glacier and just keeping a reference kicking around.

On the other hand, you have just discovered an information disclosure (host IPs) vulnerability in dropbox.

Re: Dropbox opening my docs?

#12

Post by nonchalance » Thu, Sep 12, 2013, 4:32 PM UTC

If someone from honeydocs is reading this ...

The tracking behavior depends on a tracking pixel which may not always be processed by the client.

For example, with the credit_cards sample, the xls file is actually an HTML file with an img at the end (url linking to https://honeydocs.herokuapp.com/img/xls/...) and a client that only reads the plaintext (there are a boatload of command line utilities that fit the bill) won't fetch the image.

Re: Dropbox opening my docs?

#13

Post by blcknight » Thu, Sep 12, 2013, 4:33 PM UTC

steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

I just tried this with a doc file, and the buzz was nearly instantaneous, within seconds -- 3 buzzes total.

Certainly it's automated.

Paranoid part of me says it's NSA keyword scanning. I feel a little insane suggesting that, but it's certainly conceivable these days.

The other possibility is Dropbox is indexing the files for search?

Anyway, using Dropbox unecrypted is a terrible idea. EncFS has user-friendly frontends like Boxcryptor.

Re: Dropbox opening my docs?

#14

Post by [deleted] » Thu, Sep 12, 2013, 4:33 PM UTC

[deleted]

Re: Dropbox opening my docs?

#15

Post by 0x0 » Thu, Sep 12, 2013, 4:33 PM UTC

steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

Many XML parsers will resolve external entities by default.

Re: Dropbox opening my docs?

#16

Post by nigma » Thu, Sep 12, 2013, 4:34 PM UTC

They are generating PDF for online viewing. Go to your files on dropbox site and click on a .doc file. A preview popup will appear.

Open/LibreOffice with Python bridge is quite handy in converting documents to PDF format and can be run in headless mode (using virtual frame buffer like xvfb) on a server.

Re: Dropbox opening my docs?

#17

Post by robinduckett » Thu, Sep 12, 2013, 4:34 PM UTC

Guillaume86 wrote: post #2

Isn't that a thumbnail generation from dropbox? I remember a thumbnail entry in their API.

Thumbnail generator is most likely. I'm suprised Libreoffice will allow a GET call to an external website like that though.

Re: Dropbox opening my docs?

#18

Post by rgbrenner » Thu, Sep 12, 2013, 4:36 PM UTC

steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

If all documents are showing as opened within 10 minutes, then surely it is just an anti-duplication automated agent at work.

It could perhaps be from generating a thumbnail... But dedup wouldn't work like that.. I would be very concerned about a dedup algo that requires interpreting the contents of a file, and dedup'ing based on that.

Re: Dropbox opening my docs?

#19

Post by pwg » Thu, Sep 12, 2013, 4:39 PM UTC

Much ado about nothing.

If you don't want your cloud storage provider reading the data you give them, then _encrypt_ that data _before_ you upload it.

Re: Dropbox opening my docs?

#20

Post by gjulianm » Thu, Sep 12, 2013, 4:40 PM UTC

blcknight wrote: post #13

steven777400 wrote: post #4

On the one hand, it seems unlikely that an automated process would trigger external resource retrieval. In the same way, most processes that scan webpages for content or similarities don't run JavaScript, unless they are very sophisticated (this used to be a good way to protect against spam bots, for instance). On the other hand, given how many files are uploaded to dropbox every hour, it's inconceivable that a human…

I just tried this with a doc file, and the buzz was nearly instantaneous, within seconds -- 3 buzzes total. Certainly it's automated. Paranoid part of me says it's NSA keyword scanning. I feel a little insane suggesting that, but it's certainly conceivable these days. The other possibility is Dropbox is indexing the files for search? Anyway, using Dropbox unecrypted is a terrible idea. EncFS has user-friendly fronten…

Keyword scanning shouldn't resolve images, unless they're using OCR to read any text they have. In that case, they'd be wasting a lot of resources.