11–20 of 48 posts
Anyone who had any confidential data in Dropbox (medical research data, credit card transaction data) must now file a data breach report.
Anyone who had any confidential data in Dropbox (medical research data, credit card transaction data) must now file a data breach report.
Earlier quoted context omitted.
The thing is that you can't do email then. You can say that google might leak your emails, but the same is true if you use your private email server.
That's not exactly true. You just need to be super-paranoid and make sure that everything of importance is sent (on both ends) encrypted. That's still wholly untenable for the real world, but not all paranoid people live in the real world per se.
If this happens, let's look forward to a trove of blogposts about "how to make dropbox secure" from armchair CTOs, just like we saw with Twitter and the string of posts around "How I'd scale twitter" Sharding! Webscale!
Dropbox's security is twitter's downtime. While much more is at stake than not being able to tweet, I can't imagine that this isn't their number one growth challenge -- something that, if they conquer it, will give them a much higher market valuation. If this happens, let's look forward to a trove of blogposts about "how to make dropbox secure" from armchair CTOs, just like we saw with Twitter and the string of posts…
Anyone who had any confidential data in Dropbox (medical research data, credit card transaction data) must now file a data breach report.
Do people really store confidential business data like that in dropbox?
Grandalf's point is extremely well taken. It's actually true. Not only that, but regulated companies (in health care and finance) that have a reasonable belief that any of their systems might have had Dropbox on them technically need to audit now.
I point this out not to bag on Dropbox, but as an illustration of how sane some unreasonable-sounding IT policies (like, "you don't get to install random software on your desktop") turn out to be.
† (Or Tarsnap or SpiderOak, for what it's worth.)
Anyone who had any confidential data in Dropbox (medical research data, credit card transaction data) must now file a data breach report.
And anyone who stored that sort of data in dropbox more or less had it coming. HIPAA & finance laws are very clear about the security they require -- dropbox has always been hand-wavey in their explanation of their security.
Hoping this convinced someone at dropbox to write a three-line release-blocking test to ensure that you can't login with a wrong password... Crosses fingers
Another thing to do would be to change the design of the authentication process so that it is more inherently fail-closed. For instance, you could encrypt/decrypt the database ID of the user with a key derived securely and deterministically from the user's password, perhaps (just to keep the code simple) after verifying the password against a secure password hash.