Dropbox accesses all the files in your PC? • Hacker News Board

Re: Dropbox accesses all the files in your PC?

#41

Post by onderkalaci » Tue, Mar 03, 2015, 8:45 AM UTC

bobofettfett wrote: post #32

hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the ba…

I agree with you. The main problem is that why dropbox accesses the files that it is not permitted.

Re: Dropbox accesses all the files in your PC?

#42

Post by [deleted] » Tue, Mar 03, 2015, 8:46 AM UTC

zzleeper wrote: post #31

Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks . Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the sa…

[deleted]

Re: Dropbox accesses all the files in your PC?

#43

Post by onderkalaci » Tue, Mar 03, 2015, 8:47 AM UTC

psk wrote: post #24

Synchronizing all your files sounds like space-waste. It would be trivial to determine if dropbox does that, simply by monitoring the number of bytes sent to dropbox (Create a new file of size x, determine if the stream to dropbox transmits at least x amount of bytes) or by replacing the SSL certificate in the program with your own and then set up a fake server (This would be harder) to determine exactly what is bein…

Dropbox does not allow SSL interception of its traffic. It immediately errors out saying host is not trusted or smth else.

Re: Dropbox accesses all the files in your PC?

#44

Post by microtonal » Tue, Mar 03, 2015, 8:47 AM UTC

java-man wrote: post #20

microtonal wrote: post #6

Earlier quoted context omitted.

Imagin an OS where applications/serices each get their own mini-filesystem, without ability to access each other's data. OS X does this for sandboxed apps: https://developer.apple.com/library/mac/documentation/Securi... All apps from the App Store are sandboxed.

What I meant is the app/service isolation on the OS level. It should not apply just to a subset of apps, but to each and every process that runs on a device.

Because then every application would be an island and useless.

Red Hat Linux tried a variation of this with the SELinux policy that preceded the 'targeted' policy (I forgot its name). Processes that did not have a policy adding permissions would be allowed to virtually read/write nothing.

The net result was that nearly everyone switched off SELinux.

Afterwards, Red Hat worked in the opposite direction. In the so-called 'targeted' policy processes are allowed to do what a normal UNIX process is allowed to do, unless there is a policy defined for them. Since they provide policies for commonly used daemons it adds security, while not making life too hard for sysadmins. Net result: most people keep SELinux enabled and have safer systems.

Re: Dropbox accesses all the files in your PC?

#45

Post by [deleted] » Tue, Mar 03, 2015, 8:47 AM UTC

onderkalaci wrote: post #41

bobofettfett wrote: post #32

Earlier quoted context omitted.

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the ba…

I agree with you. The main problem is that why dropbox accesses the files that it is not permitted.

[deleted]

Re: Dropbox accesses all the files in your PC?

#46

Post by flipp3r » Tue, Mar 03, 2015, 8:47 AM UTC

I'm not a Dropbox user, but why doesn't anyone with Dropbox just install a local proxy and try to read out the requests made to the Dropbox servers. The speculations on spying, etc. in this thread are completely worthles, just look at what they're sending to the servers.

Re: Dropbox accesses all the files in your PC?

#47

Post by pjmlp » Tue, Mar 03, 2015, 8:48 AM UTC

zzleeper wrote: post #31

Independently of whether DB reads/uploads all the files or not, I've arrived at a difficult position about Dropbox: I'm looking for alternatives. No, it's unrelated with politics or pricing; it's just that in many cases Dropbox sucks . Why? Well, I mostly don't care about all the new features (mobile, Carousel, etc.). What I care the most is that i) it syncs files and ii) acts as a quasi-backup. However, I see the sa…

Most likely won't help you, but I just keep using external drives and DVDs for backups.

No way I am sharing private documents over the "cloud".

Re: Dropbox accesses all the files in your PC?

#48

Post by pjmlp » Tue, Mar 03, 2015, 8:50 AM UTC

java-man wrote: post #4

"collect it all" But I wonder why we don't have application isolation as a basic design principle. Imagine an OS where applications/serices each get their own mini-filesystem, without ability to access each other's data. Would that work?

Besides what everyone already mentioned. I think Symbian also did it,

Re: Dropbox accesses all the files in your PC?

#49

Post by codeonfire » Tue, Mar 03, 2015, 8:50 AM UTC

java-man wrote: post #4

"collect it all" But I wonder why we don't have application isolation as a basic design principle. Imagine an OS where applications/serices each get their own mini-filesystem, without ability to access each other's data. Would that work?

do you mean chroot. Unix had that in 1979.

Re: Dropbox accesses all the files in your PC?

#50

Post by tjohns » Tue, Mar 03, 2015, 8:50 AM UTC

java-man wrote: post #23

tjohns wrote: post #7

Earlier quoted context omitted.

That's the basic idea behind sandboxing, and it's a model that a lot of newer OSes are moving towards, especially in mobile. Android does this for all apps, as does iOS. MacOS is also doing it for apps downloaded from the App Store. On the server side, that's also one of the things that Docker gives you.

So, if someone finds a vulnerability in Docker software and roots a process, your filesystem is safe? The idea is not sandboxing, it's "multiverse". Each process, even an OS one, gets its own little filesystem, and connects to a limited set of interfaces explicitly permitted by the user (and that can be audited by the user).

> So, if someone finds a vulnerability in Docker software and roots a process, your filesystem is safe?

You could make the same argument about a vulnerability in the OS itself. There's nothing magic about kernel code that gives it extra protection here. :)

In fact, I'd argue that the most probable attack against Docker would already be via a vulnerability in the OS. Docker uses a lot of kernel-level technologies, like cgroups. Beyond that, the most likely way to escape a Docker sandbox would be by finding a buggy syscall, since these weren't always designed with containers in mind.

This presentation is a good overview of Docker's attack surface: http://www.slideshare.net/jpetazzo/linux-containers-lxc-dock...

> Each process, even an OS one, gets its own little filesystem, and connects to a limited set of interfaces explicitly permitted by the user (and that can be audited by the user).

That would be an interesting research project, at the very least. You'd probably have to rewrite much of userspace, since it breaks many of the assumptions the current generation of system tools rely on.