Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dropbox Lack of Security

tirania.org

Post reply on HN
Print view View original

151–160 of 193 posts

Re: Dropbox Lack of Security

#151

Post by marshray »

merijnv wrote: post #146
zdw wrote: post #140

Earlier quoted context omitted.

If you dupe someone's Dropbox host ID, they'll only see the one entry on their page, so it's quite likely they would not be aware that they've been "duped".

To dupe the key they would need access to your system, though. At which point they would also have access to all your files anyway. Now, if you fix your system to no longer be vulnerable the duped key will allow them to keep snooping your files, but personally I think this risk is marginal.

Whether or not the risk is marginal depends on the circumstances of the user. I there's probably a time and an place for this security model, though I don't see myself using it.

I see two key questions:

* Has the security model has been properly implemented?

* Have its properties have been communicated to the users of the system in a clear enough way that people can evaluate how the risks apply to them?

I don't know about the first question, but on the second they could certainly stand some improvement.

Re: Dropbox Lack of Security

#152

Post by njs12345 »

tlrobinson wrote: post #88
Groxx wrote: post #78

Earlier quoted context omitted.

Have fun decrypting AES in Javascript, and downloading the file through your browser. (edit: on your cell phone...)

Hint: downloading client-side generated files is not possible without assistance from Flash.

Not quite true: http://jszip.stuartk.co.uk/

Re: Dropbox Lack of Security

#153

Post by TillE »

donpark wrote: post #139
latch wrote: post #124

Earlier quoted context omitted.

Agreed. Except a lot of companies have a lot of " financial incentives at stake to be diligent security wise" but aren't. Something I very recently heard: "World of Warcraft has had RSA-style two-factor token authentication for years, and my bank still doesn't"

Some thoughts re WoW vs banks: WoW Authenticator is optional, costs $30~40, and intended for serious WoW players in a community with very strong peer support. Banks can do first two but don't have a community of tech savvy users to reduce cost of support manageable. So Blizzard could but banks couldn't. Will this change? I think so but it'll have to be opt-in and paid for by customers, likely through third-party serv…

Every bank in Germany (that I know of) uses TAN lists. They mail you a list of generated numbers, and for each transaction, you need to enter one of those numbers, which is then consumed.

No fancy gadgetry required. Just a sheet of paper gives you all the same security advantages.

Re: Dropbox Lack of Security

#154

Post by 16s »

thaumaturgy wrote: post #49
patio11 wrote: post #32

This is the first time I've heard someone on HN actually ask for more security theatre. Sure, Dropbox could spend seven figures to get a ISOxxxx whatever consultancy to draw up a 125 page document describing their internal checks, do the obligatory all-hands yearly mandatory training where you have to get 10/10 questions right and question 1 is "A user has uploaded naked pictures of themselves to their account. True…

That's a severe oversimplification, IMO. Just recently there was news that duplicating the host_id from the Dropbox config onto another system will immediately gain access to all of the Dropbox files associated with that host_id, without further authentication. It's not security theatre to acknowledge that the security in such a system could be improved, especially as an option for those that require it. #3 could eas…

Great points. Trust and hope are not IT Security Controls.

Take the matter into your own hands and GPG encrypt everything that you place into the cloud. That way, only you hold the decryption key. I'm sure this may violate their ToS and it is inconvenient for end-users, but in order to have a firm technical control, you have to remove "trust and hope" from the equation.

Re: Dropbox Lack of Security

#155

Post by acdha »

loumf wrote: post #133
csallen wrote: post #121

Dropbox didn't lie. This is simply a misinterpretation (or misunderstanding) of what's meant by the phrase "Dropbox employees aren't able to access user files". It's not the same as saying "It's impossible." The fact is, if you send a company your unencrypted data, it's obviously possible for them to view it at some point. Otherwise they could never encrypt it in the first place. So when they say that employees aren'…

The plain English meaning of the words "aren't able to access user files" is not the same as "choose not to access user files". Dropbox could just keep keys in a store where only automated user accounts can get to them -- ones where only the founders have passwords, or they are in escrow. I think there are ways to restrict the access to founders and a fail-safe, without opening them up to anyone who works at Dropbox.

If you run their client you've already made the decision to trust them to behave responsibly. The rest of this discussion is simply about obfuscation.

Re: Dropbox Lack of Security

#156

Post by sunchild »

mentat wrote: post #147
sunchild wrote: post #141

Earlier quoted context omitted.

It could be even simpler: Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed. When I started my own law practice, my partners insisted that "everything must be encrypted" so that no third parties would have access to see any files. I had a feeling my partners were parroting this requirement and didn't really understand how security works. I tried to explain the pros…

"Dropbox's admin interfaces for employees may simply not reveal data that could technically be revealed" This is not the same as "is not accessible to employees". Interfaces are just that. There are quite a few very sharp developers at Dropbox if reputations are to be believed. I don't think an interface is a sufficient control.

I fully understand your point, but those words could be interpreted either way.

Only Dropbox can confirm whether it is theoretically possible for Dropbox engineers to peek at user data.

Re: Dropbox Lack of Security

#157

Post by gbog »

tzs wrote: post #5

It is possible to design a Dropbox-like system with the following properties: 1. Files are stored encrypted. 2. The service provider does not have the ability to arbitrarily decrypt the files. By "arbitrarily decrypt" I mean decrypt at any time they wish. They will be able to decrypt if the owner's client is actively connected. 3. When someone uploads a file that is identical to an existing file, it initially is stor…

This should not be a service, this should a protocol, with RFC.

Re: Dropbox Lack of Security

#158

Post by bdhe »

thaumaturgy wrote: post #81
bdhe wrote: post #43

Earlier quoted context omitted.

> because they make them available to you through the web interface. You could have client side javascript that decrypts the files. http://crypto.stanford.edu/sjcl/

You're getting (maybe unfairly) downvoted because the popular opinion in security is that client-side JavaScript anything is worthless in terms of security. Since it's not authenticated in any way by the browser, any successful MITM attack on a connection can feed malicious JavaScript which would request the user's key. Or, a malicious add-on in the browser could do the same. Or, possibly, an XSRF. I'm somewhat skept…

Thanks for the information. I didn't realize that it is verboten. I presumed it was for efficiency purposes and implementation hassles. I do realize that there are plenty of attack vectors the moment you start trusting JS from a remote website.

It was just a proof-of-concept of how Dropbox can still allow you to view files in your browser, but perhaps flash a big warning saying that this is a lot weaker security-wise than locally running your dropbox client. That way they cater to people who are willing to forego a little security for convenience.

Re: Dropbox Lack of Security

#159

Post by nkassis »

16s wrote: post #154
thaumaturgy wrote: post #49

Earlier quoted context omitted.

That's a severe oversimplification, IMO. Just recently there was news that duplicating the host_id from the Dropbox config onto another system will immediately gain access to all of the Dropbox files associated with that host_id, without further authentication. It's not security theatre to acknowledge that the security in such a system could be improved, especially as an option for those that require it. #3 could eas…

Great points. Trust and hope are not IT Security Controls. Take the matter into your own hands and GPG encrypt everything that you place into the cloud. That way, only you hold the decryption key. I'm sure this may violate their ToS and it is inconvenient for end-users, but in order to have a firm technical control, you have to remove "trust and hope" from the equation.

If this violates their ToS, they need to rethink their policies. There a ton of reason you might have an encrypted file in your dropbox. Like sharing it with a friend or holding it there because you are moving files around etc.

Re: Dropbox Lack of Security

#160

Post by runjake »

All this press about Dropbox is getting ridiculous. I'm almost suspecting it's a hit job, but I'm wondering why people like De Caza are getting involved.

Pay attention to the two following rules. They are, and always have been true. Write them down if need be:

1.) The government can demand files from any US (and many non-US) companies. The company is then legally-obligated to turn them over.

In the past, the government has even successfully demanded data without the proper warrants (read about the VZW/AT&T/Qwest/NSA fiascos).

2.) Your cloud data is always subject to security breaches and provider employee abuse. Encrypt accordingly (I prefer DMG and TrueCrypt).

Why is this news? Did people not understand this?

Post reply on HN