Live data from Hacker News

Security culture, the Dropbox way

blogs.dropbox.com

11–14 of 14 posts

Re: Security culture, the Dropbox way

#11
post #2

a better approach would be implementing a zero-knowledge storage infrastructure, like tarsnap.

We call this "provider-independent security" in capability theory; the idea is that a security guarantee, like privacy or confidentiality, is inherent in the construction regardless of who is providing the service.

Re: Security culture, the Dropbox way

#12
post #8
post #4

I'm sure Dropbox takes security seriously and works hard at it but this piece doesn't tell me a lot more than that except in much longer form. You can find/replace 'trust' (and 'security') with 'truck' and come away as informed and potentially slightly more amused.

Some informative parts that keep their meaning under s/trust/truck/g include: "... daylong social engineering workshop designed and led by internal experts that immersed them in a hypothetical scenario involving a malicious insider." "... a hands-on workshop where Dropbox employees researched, crafted, and presented their own phishing schemes." "... our annual Capture the Flag" It's interesting the emphasis on social…

You forgot the really important ones, I think. Trucktober and tailgating. It does raise the interesting question of why Dropbox does not celebrate Trarch.

Re: Security culture, the Dropbox way

#13
post #9
post #7

Earlier quoted context omitted.

These sorts of hills grow to mountains with the bones of hopeful pedants who die on them. But I think there's still a chance to hold this one. That's not what 'zero knowledge' means, it's a technical term for a different thing.

you are technically correct (the best kind of correct). but it's a commonly understood concept: https://www.google.com/search?q=zero+knowledge+storage

Hold the line. This one we can still win. Hold the line.

https://spideroak.com/articles/why-we-will-no-longer-use-the...

Re: Security culture, the Dropbox way

#14
post #13
post #9

Earlier quoted context omitted.

you are technically correct (the best kind of correct). but it's a commonly understood concept: https://www.google.com/search?q=zero+knowledge+storage

Hold the line. This one we can still win. Hold the line. https://spideroak.com/articles/why-we-will-no-longer-use-the...

I surrender! End-to-end encrypted cloud storage with client- managed keys...
Post reply on HN