Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox accesses all the files in your PC?

e-siber.com

Post reply on HN
Print view View original

141–150 of 158 posts

Re: Dropbox accesses all the files in your PC?

#141

Post by zwily »

kweinber wrote: post #132
pudquick wrote: post #55

Earlier quoted context omitted.

FYI - they do certificate pinning for their clients and won't let you proxy the HTTPS connections, last I checked. I'm not saying this as cause for alarm. Obviously if they were sending the files you could measure the volume of traffic if nothing else. Make a completely random non-compressible file that's of an arbitrarily significant size (say 1M+) and see if that amount of traffic goes out to them. I do think Dropb…

If anyone has a lenovo box, they could use its Superfish feature to get around this.

Superfish doesn't get around pinned certificates.

Re: Dropbox accesses all the files in your PC?

#142

Post by lucb1e »

nissehulth wrote: post #140
tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

I don't think this is related to FileSystemWatcher (or ReadDirectoryChangesW) at all. I believe the author is just confused by the shell extension. Every time you right click a file in explorer, this type of "file access" would happen.

But then an explorer.exe process would access the file, not Dropbox. The screenshots clearly show that it detected Dropbox accessing something.

Re: Dropbox accesses all the files in your PC?

#143

Post by lucb1e »

ohitsdom wrote: post #131
atmosx wrote: post #117

Earlier quoted context omitted.

I am on mac, I have littlesnitch and I also have Geektool display network connections. Dropbox is not always "active". I don't see any kind of network traffic after syncing has been done under macosx.

It needs to at least be periodically active to sync in case you add a file with another device.

Periodically yes, but open TCP connections can technically last for days (although this is implementation-specific) without any packets being sent across.

You're right of course, periodic data needs to be sent even if just to keep the TCP connection open, but it's not much and it's not often.

Re: Dropbox accesses all the files in your PC?

#144

Post by lucb1e »

hamstergene wrote: post #26

This article does not prove "steals everything" claim. Very shallow work for "Information Security Specialist". The reason Dropbox accesses files all over the drive may be that FS events driver generates events for every file accessed by every program, and Dropbox has to read their metadata for some reason (e.g. to check if their full path is under one of synced folders). He should elaborate by checking if Dropbox is…

Maybe not file contents, but it could be uploading filenames for whatever reason.

I'm not saying it is, but your assertion that it uploads all file contents is wrong.

Re: Dropbox accesses all the files in your PC?

#145

Post by lucb1e »

zwily wrote: post #141
kweinber wrote: post #132

Earlier quoted context omitted.

If anyone has a lenovo box, they could use its Superfish feature to get around this.

Superfish doesn't get around pinned certificates.

Plus, anyone can create a root certificate and install it in their own trust store. You don't need Superfish.

I think kweinber was kidding, though.

Re: Dropbox accesses all the files in your PC?

#146

Post by a3_nm »

exDM69 wrote: post #135
a3_nm wrote: post #112

Earlier quoted context omitted.

Would this really work? I would expect the SSL certificate of Dropbox's servers to be hardcoded in the client, so the client would refuse to connect to an interceptor.

The Dropbox client is running with normal user privileges on a computer that you have root access to. It should be possible to use reverse engineering/debugging tools to either bypass SSL checks or analyze the dropbox client binary to see what is being sent/recvd.

Sure, I'm just saying it would be less straightforward than mitmproxy. I wonder if there are tools to hook into whatever SSL library is being used (OpenSSL?) and intercept traffic before it gets encrypted and after it gets decrypted? (probably using LD_PRELOAD, like tsocks)

Re: Dropbox accesses all the files in your PC?

#147

Post by army »

frossie wrote: post #29
ivanche wrote: post #18

As you see below, Dropbox says that "only checked folders will sync to this computer" Very interesting wording. I don't want to play conspiracy theory, but it only says what will sync to the computer. It doesn't say anything about what will sync (or upload) to the cloud.

That is because that is the ACTUAL purpose of that (Selective Sync) dialogue he is showing, contrary to his implication that it is related to upload configuration. When you have 2 work computers and one personal laptop, perhaps you have a CAD Drawings folder that you would like to sync between your work computers but don't want 100 GB of work stuff on your personal laptop. What the Selective Sync feature allows you t…

Nice feature or cunning conspiracy you be the judge.

Re: Dropbox accesses all the files in your PC?

#148

Post by aabaker99 »

blergh123 wrote: post #79

I didn't really think about it before, but I now feel very uncomfortable that Dropbox has copies of my unencrypted files. I would feel much better if the files were encrypted before being synched. Is there a service that does this? I don't want Dropbox to be able to see the contents of my file system at their end.

I'm not sure what your OS is but I do something documented at [0] to encrypt my Dropbox files. The encfs approach also makes it easy to decrypt all of them for use. I'd even say with a little more fine tuning (running encfs on startup, for example), the process could be pretty automated. There's even an Android app that you can use (though it's a little more tedious) to decrypt the files on mobile.

[0] https://wiki.archlinux.org/index.php/Dropbox#Setup_EncFS_wit...

Re: Dropbox accesses all the files in your PC?

#149

Post by ForHackernews »

Maakuth wrote: post #86
yc1010 wrote: post #72

Earlier quoted context omitted.

They could look for bitcoin wallet files, thats what typical malware does nowadays. Could theorethically only takes the infection of one computer to strike it rich.

That would be a solid line of thought if this would be some shady adware from some unknown company. But Dropbox is valued more than $10B, that's more than twice the market cap of all Bitcoin. Even if everyone at Dropbox went criminally insane, there would be no way for them to recover even a reasonable fraction of it in BTC markets. Not to mention it would completely kill their reputation and thus the highly-valued b…

Lenovo is a $16B company, and we learned they're breaking SSL and man-in-the-middle attacking all their customers. I think we should be careful in not assuming "big, rich company" means "sensible, responsible company"

Also, theoretically, it could be a single (or a few) developers going rogue, rather than an approved company policy. It wouldn't be the first time.[0]

[0] http://www.tomsguide.com/us/David-Barksdale-Google-Engineer-...

Re: Dropbox accesses all the files in your PC?

#150

Post by beaugunderson »

poizan42 wrote: post #99
beaugunderson wrote: post #58

Earlier quoted context omitted.

I copied a file in C:\ and saw Dropbox access it a few moments later, followed by network activity: http://cl.ly/image/443Y1S092g1R

Uhm no. It calls QueryBasicInformation and closes it again right after.

Do you think QueryBasicInformation is a mischaracterization of the word "access"?
Post reply on HN