Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox accesses all the files in your PC?

e-siber.com

Post reply on HN
Print view View original

31–40 of 158 posts

Re: Dropbox accesses all the files in your PC?

#31

Post by zzleeper »

Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks.

Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the same old bugs from years ago and nothing gets done. To name just a few:

- If I copy a file to the Dropbox folder in Windows, it will convert it to small caps, even if the file is in Camel Case. Yes, I get that for windows caps are just "optional", but do not change it just for the sake of it!

- Many people sometimes have temporary files. Photoshop, Matlab, Word, Latex, etc. leave crumbles of temp files and folders. Can't I just set a quick rule to avoid "tmp" folders and e.g. ".tmp" files?

- A few months ago their forums went down and stayed down for around a month? Why? Technical problems. But the real reason is that they don't really care.

There is no way DB can justify their valuation with just the syncing part, and I'm fine with that. But just stopping altogether to improve in that area is a huge turn-off, and on top of that they do not care to fix bugs (there were hundreds of bug requests about the lowercase bug in the forums, before they deleted it).

Now that my rant is over, I ask you: are there any useful alternatives? I've heard that GDrive is very slow and the MSFT alternative seems a bit risky to me (will it work on Linux in the future? will it be customizable?).

Re: Dropbox accesses all the files in your PC?

#32

Post by bobofettfett »

hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect.

"It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB"

Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the basic assumption.

Re: Dropbox accesses all the files in your PC?

#33

Post by microtonal »

vferreira wrote: post #3

The article covers the dropbox app on windows. How about others platforms, like OS X?

I dtruss-ed the dbfseventsd instances, while creating a file in my home directory, and I do see stuff like:

    833/0x1c7d:  read_nocancel(0x6, "/Users/daniel/foobarbaz\0", 0x17)		 = 23 0
    833/0x1c7d:  access("/Users/daniel/foobarbaz\0", 0x4, 0x17)		 = 0 0
Same thing for temporary directories (/private/var/folders), Chrome caches, etc. So, at the very least they seem to monitor the whole filesystem for events.

Maybe that's even necessary, though:

https://developer.apple.com/library/mac/documentation/Darwin...

seems to suggest it's not.

Re: Dropbox accesses all the files in your PC?

#34

Post by cevn »

agopaul wrote: post #25
orik wrote: post #16

Earlier quoted context omitted.

The article draws a pretty solid argument, if you wanted to confirm results yourself I'd suggest creating a windows vm, installing dropbox, and getting a packet capture of the traffic leaving when you drop a .docx file in the C:// directory. It's not a stretch of the imagination that dropbox could still be making a profit spending bandwidth and storage space this way. I can think of a government agency or two that wo…

You say solid, but I don't see any proof that the client actually send the file. Without something like a strace analysis, you can't really know for sure if the file was even read completely and sent to the Dropbox servers

I really, really doubt that the client actually sends the file. But, imagine if they read only metadata and uploaded that.

I agree with what another commented brought up - it's probably just unfortunately overaggressive 'filesystem-watch' code - IE when you change a file it checks to see if it needs to be synced and re-uploaded. It shouldn't be able to affect other files, though. Makes me wish we had more nuanced security controls, like per-app permissions a la Android/IOS.

Re: Dropbox accesses all the files in your PC?

#36

Post by yc1010 »

bobofettfett wrote: post #28

What if they upload file hashes? What if they upload name+type+size to fingerprint files? They don't need to upload file contents for fingerprinting your drive content.

Hmm there is a business model right there!

Fingerprint popular torrent movie/tv/games etc files and then monitor (via dropbox) their spread and how many computers around the world they end up on, I bet movie studios would love to measure exactly how much piracy affects them

shiiiittt

Re: Dropbox accesses all the files in your PC?

#37

Post by bobofettfett »

yc1010 wrote: post #36
bobofettfett wrote: post #28

What if they upload file hashes? What if they upload name+type+size to fingerprint files? They don't need to upload file contents for fingerprinting your drive content.

Hmm there is a business model right there! Fingerprint popular torrent movie/tv/games etc files and then monitor (via dropbox) their spread and how many computers around the world they end up on, I bet movie studios would love to measure exactly how much piracy affects them shiiiittt

And we know automatic DCMA bots work on size and name alone.

Re: Dropbox accesses all the files in your PC?

#38

Post by merlish »

zaroth wrote: post #15

"Access" is a bit vague. It's one thing if their 'fstat' is leaking, it's another thing if they are actually reading all the bytes of those files. Another piece of evidence I'd like to see is a mitmproxy checking out what's under that TLS session. Improper local reads are one thing, it's another thing entirely if they are communicating back file names, hashes and/or the file data actual.

My personal theory is it's something to do with Dropbox's Explorer shell extension.

(But I really don't know enough to day for sure. Still, if the shell extension mechanism is such that you get a file or list of files, it'd need to figure out whether they're in a Dropbox folder or not and play with the icons.)

Re: Dropbox accesses all the files in your PC?

#39

Post by [deleted] »

zzleeper wrote: post #31

Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks . Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the sa…

[deleted]

Re: Dropbox accesses all the files in your PC?

#40

Post by mappu »

zzleeper wrote: post #31

Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks . Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the sa…

GPL Unison?

Add in encfs with a cheap storage VPS for off-site redundancy. It should run on android too if you have a normal-looking chroot installed.

Post reply on HN