Dropbox accesses all the files in your PC? • Hacker News Board

Re: Dropbox accesses all the files in your PC?

#131

Post by ohitsdom » Tue, Mar 03, 2015, 1:24 PM UTC

atmosx wrote: post #117

umurkontaci wrote: post #95

Earlier quoted context omitted.

Dropbox is always connected and continually checks for updates, just because one sees at the same time doesn't mean they are related. I see Dropbox connections all the time whenever I look through my network.

I am on mac, I have littlesnitch and I also have Geektool display network connections. Dropbox is not always "active". I don't see any kind of network traffic after syncing has been done under macosx.

It needs to at least be periodically active to sync in case you add a file with another device.

Re: Dropbox accesses all the files in your PC?

#132

Post by kweinber » Tue, Mar 03, 2015, 1:34 PM UTC

pudquick wrote: post #55

flipp3r wrote: post #46

I'm not a Dropbox user, but why doesn't anyone with Dropbox just install a local proxy and try to read out the requests made to the Dropbox servers. The speculations on spying, etc. in this thread are completely worthles, just look at what they're sending to the servers.

FYI - they do certificate pinning for their clients and won't let you proxy the HTTPS connections, last I checked. I'm not saying this as cause for alarm. Obviously if they were sending the files you could measure the volume of traffic if nothing else. Make a completely random non-compressible file that's of an arbitrarily significant size (say 1M+) and see if that amount of traffic goes out to them. I do think Dropb…

If anyone has a lenovo box, they could use its Superfish feature to get around this.

Re: Dropbox accesses all the files in your PC?

#133

Post by ytdht » Tue, Mar 03, 2015, 1:39 PM UTC

Fice wrote: post #81

They might or might not steal your files, but the mere fact that to use their service you have to install proprietary software is a reason not to trust them.

You don't have to install any Dropbox software besides using the web app... just like you don't have to install Chrome to use Gmail (yet)

Re: Dropbox accesses all the files in your PC?

#134

Post by moe » Tue, Mar 03, 2015, 1:46 PM UTC

a3_nm wrote: post #116

moe wrote: post #75

Earlier quoted context omitted.

I ran unison for a while but the conflict resolution was unfortunately lacking. It repeatedly stopped sync'ing properly until I intervened manually. A few months ago I switched to csync[1], which looks better so far. [1] https://www.csync.org/

The last csync release is from August 2013. Is the project still alive?

I don't know. It simply works for me ever since I installed it (on linux and OSX) so I never bothered to check for updates.

Re: Dropbox accesses all the files in your PC?

#135

Post by exDM69 » Tue, Mar 03, 2015, 1:48 PM UTC

a3_nm wrote: post #112

umurkontaci wrote: post #96

Earlier quoted context omitted.

Simple. Put up an SSL interceptor proxy and see what's going through.

Would this really work? I would expect the SSL certificate of Dropbox's servers to be hardcoded in the client, so the client would refuse to connect to an interceptor.

The Dropbox client is running with normal user privileges on a computer that you have root access to. It should be possible to use reverse engineering/debugging tools to either bypass SSL checks or analyze the dropbox client binary to see what is being sent/recvd.

Re: Dropbox accesses all the files in your PC?

#136

Post by benwaffle » Tue, Mar 03, 2015, 1:56 PM UTC

microtonal wrote: post #85

jablan wrote: post #83

Earlier quoted context omitted.

Unfortunately btsync is very much not open-source. There are alternatives, though. I am very satisfied with syncthing[1], although it didn't have usable mobile app last time I checked. [1] http://syncthing.net/

And requires port forwarding, which may not be an option for people who are not on IPv4 at home (e.g. my ISP uses DS-Lite, so I cannot use IPv4 port forwarding). Bittorrent Sync works pretty good. Somebody should reverse engineer the protocol and make an open source client. Edit: why the heck is the grandparent downvoted? He/she offers a good suggestion.

or ownCloud

Re: Dropbox accesses all the files in your PC?

#137

Post by userbinator » Tue, Mar 03, 2015, 2:04 PM UTC

hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist".

He has shown - and others here in the comments have verified (https://news.ycombinator.com/item?id=9136740 ) - the file access. It's not a "read contents" though, but only reading metadata.

He has shown there is network activity.

He has NOT shown what exactly that network activity consists of. Without that, the "steals everything" claim is just jumping to conclusions.

As others here have mentioned, setup a proxy and look at the actual data being transferred. Replace the certificate in the client if you have to, to get around cert pinning. The most important part is to get the data. This should be pretty easy to do for someone who claims to have those qualifications.

Shallow work indeed. This reminds me of the Samsung keylogger story a few years ago where a "security professional" ran one AV software, which falsely identified the presence of a single folder's path as a keylogger, and then based on this one data point and blind faith in his AV, claimed there was a keylogger preinstalled on some Samsung laptops. This made the news and was spread widely... yet he had not even taken the most basic step of looking at the contents of that folder, which would've instantly disproved the theory.

This is an example of the right way to investigate and substiantiate your claims:

http://doctorbeet.blogspot.ca/2013/11/lg-smart-tvs-logging-u...

Sadly, we'll probably see a round of "Dropbox steals your data!" going through the media before someone steps up with the truth. I personally don't use Dropbox and don't have the time to verify these claims --- but the onus should be on the one making them in the first place.

"Extraordinary claims require extraordinary evidence."

Re: Dropbox accesses all the files in your PC?

#138

Post by morganvachon » Tue, Mar 03, 2015, 2:14 PM UTC

bobofettfett wrote: post #32

hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

Or maybe not. Your speculation is as good as mine. Or the op. Or everyone else. The point was Dropbox is accessing files outside the folder, something I would not want or expect. "It is incredibly hard for me to believe that Dropbox has sneakily transferred >1TB" Did they transfer hashes? name+type+size for fingerprinting? Searching for credit numbers or SSNs? Who knows. I don't. And don't do evil is no longer the ba…

I would be very interested in seeing if Dropbox does the same thing the author claims, but on non-Windows OSes. There are official Dropbox packages for OS X, Debian-based Linux distros, Fedora/Redhat and derivatives, and a source release for packaging the binary for other OSes. If the same or similar activity is seen on other OSes, something's afoot. If the issue only shows up on Windows, it's likely a Windows-only issue or quirk (but could still be nefarious and only targeting Windows users, though personally I'm not that paranoid).

Re: Dropbox accesses all the files in your PC?

#139

Post by neckro23 » Tue, Mar 03, 2015, 2:20 PM UTC

pudquick wrote: post #66

gnud wrote: post #60

Earlier quoted context omitted.

Just some more information: Dropbox does not read the file outside the dropbox folder. It does, however, 'QueryBasicFileInformation' and and 'QueryDirectory' when I create a file on my desktop. I'm guessing this has to do with the explorer extension.

This is the first comment in this discussion I've seen that is actually interesting and might provide an explanation. The Dropbox file status symbols are a -big hack-. Up until OS X 10.10, for instance, the file browsing interface didn't provide per-file badging at the OS API level. So they literally had to patch the running Finder process to do this. I wouldn't be surprised to learn something similar is going on wit…

Windows has a standard way of doing this, no? I've seen other Windows apps like TortoiseSvn do icon overlays too.

Re: Dropbox accesses all the files in your PC?

#140

Post by nissehulth » Tue, Mar 03, 2015, 2:25 PM UTC

tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

I don't think this is related to FileSystemWatcher (or ReadDirectoryChangesW) at all. I believe the author is just confused by the shell extension. Every time you right click a file in explorer, this type of "file access" would happen.