Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox accesses all the files in your PC?

e-siber.com

Post reply on HN
Print view View original

151–158 of 158 posts

Re: Dropbox accesses all the files in your PC?

#151

Post by greenleafjacob »

tallanvor wrote: post #125
SpaceInvader wrote: post #103

Earlier quoted context omitted.

Why it is scanning files outside of the agreed location?

It depends on the method they're using to monitor for changes to files and the type of filter being used. They're probably trying to reuse code across clients, so I'm not sure what method they're using. --ReadDirectoryChangesW makes the most sense, but maybe they've done it differently. If someone really wants to figure it out, it's probably possible to attach a debugger to try and catch the calls being used, but sin…

You don't need debugging symbols to trace system calls.

Re: Dropbox accesses all the files in your PC?

#152

Post by mietek667 »

Dropbox doesn't access all your files, it just hooks to explorer.exe and then whatever directory you open in explorer Dropbox will query info about that directory, files and subdirectories. To test this, just close every explorer window, run Total Commander and Process Monitor, and use Total Commander to do your stuff, you will see that Dropbox won't be quering directories/files.

And about that connections to dropbox servers, it needs them to sync files if they were uploaded from another computer/smartphone.

Re: Dropbox accesses all the files in your PC?

#153

Post by [deleted] »

tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

[deleted]

Re: Dropbox accesses all the files in your PC?

#154

Post by _razvan »

SpaceInvader wrote: post #103
tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

Why it is scanning files outside of the agreed location?

What happens here is that Windows Explorer asks Dropbox whether it should display a green or blue icon for a file. It does this for all files, including those outside of the Dropbox folder.

Full analysis here: https://news.ycombinator.com/item?id=9139657

Re: Dropbox accesses all the files in your PC?

#155

Post by quotemstr »

beaugunderson wrote: post #150
poizan42 wrote: post #99

Earlier quoted context omitted.

Uhm no. It calls QueryBasicInformation and closes it again right after.

Do you think QueryBasicInformation is a mischaracterization of the word "access"?

QueryBasicInformation is like a subset of stat(2). It can't access a file's contents. While I'd prefer Dropbox not to go looking at file metadata on my whole device, I'd chalk this one up to over-eager coding and not some kind of data-smuggling backdoor.

Re: Dropbox accesses all the files in your PC?

#156

Post by geofft »

huhtenberg wrote: post #127
tallanvor wrote: post #122

Earlier quoted context omitted.

I'm not sure if Dropbox is managed code or not. FileSystemWatcher does implement ReadDirectoryChangesW, which would allow them to set specific directories to watch. They may be using change journals instead, though, which function differently. Either way, I'm fairly certain that checking file properties (as would be done to check whether or not a filter applies) would be registered as opening the file.

Change journals are read from the volume directly and there's no evidence in the ProcMon logs (posted elsewhere here) that Dropbox uses them. > I'm fairly certain that checking file properties (as would be done to check whether or not a filter applies) would be registered as opening the file. Bzzt, nope. Wrong again. You should really try and not comment on things that you are not well-versed at. This part in particu…

And how, precisely, do you expect someone to become well-versed in something while trying not to comment on it?

Re: Dropbox accesses all the files in your PC?

#157

Post by nickcano »

SpaceInvader wrote: post #103
tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

Why it is scanning files outside of the agreed location?

Well, it's not 'scanning files'. It's scanning meta-data about directories and files.

You can see three calls for each file in the ProcMon logs:

1. CreateFile

2. QueryBasicInformationFile

3. CloseFile

Let's go through these in order:

1. Opens a handle to the file, allowing the application to query meta information, read, and write

2. Queries meta information about the file.

3. Closes the handle to the file before doing anything else, including reading data.

There's no scanning of files, because no data is read. Its common for applications to traverse directories like this, and the behavior could even be a consequence of a file system library or API that dropbox is using. If you think of your file system as a filing cabinet, what DropBox is doing might be equivalent to opening every drawer looking for a single file.

ProcMon detects CreateFile and QueryInformationFile using these function codes:

https://msdn.microsoft.com/en-us/library/ff548630(v=vs.85).a...

https://msdn.microsoft.com/en-us/library/ff549283.aspx

As you can see, neither of these indicates a file being read. It also monitors a number of other codes (I'm not sure how specifically it detects CloseFile), including this one, which is triggered when data is read from a file:

https://msdn.microsoft.com/en-us/library/ff549327(v=vs.85).a...

If that was being called, ProcMon would show it, but it doesn't

Re: Dropbox accesses all the files in your PC?

#158

Post by vsl »

tomp wrote: post #93
tallanvor wrote: post #91

In Windows, even with a filter limiting which directories to process, a FileSystemWatcher object has to examine each event and decide whether or not to call the event handler or let it pass without action. That means it would have to read the file information and compare it against the filters that have been defined. These actions will show up as at least 4 or 5 entries in Process Monitor (and maybe more, I'm not sur…

This explains the first part (Dropbox accessing the files), but not the second part (synchronous network activity).

Correlation does not imply causation.
Post reply on HN